18c347128b7a0ba766b2c2ed9455827d7b8cb8ab474de8d42c88f4b4b870d792

Analysis

max time kernel
143s
max time network
144s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
13/07/2024, 21:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

435a23f29872e1aee028d028ce071f08_JaffaCakes118.html
Size

99KB
MD5

435a23f29872e1aee028d028ce071f08
SHA1

eabde46ae72b2da3ac1dd9157c91f521fe34f114
SHA256

18c347128b7a0ba766b2c2ed9455827d7b8cb8ab474de8d42c88f4b4b870d792
SHA512

818a418e09b15dc6982ed688f7082a70c66d8d95649ac49581de4c88c85237827d3bd5287cbb06fd1120bbd60898707c8aa65c001affd556bfb709a4e75011a5
SSDEEP

1536:SLS2mzpQs5KRvgmCAdCWzZ2wQzRskpFbN711cX:SLSNQdC5TzRZFbNB1cX

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "427066893"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{535A9241-415C-11EF-B467-D2C9064578DD} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 6073122c69d5da01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a3d5a058b71c4645a1a6b8b9d2c7fb47000000000200000000001066000000010000200000007cff787905e9f6572f75933f02b9e0ddc6a156b163d768e9728e50334cbfa026000000000e80000000020000200000000237318197852bafd237b4e31a787fb46495f47eead7e5cd2b33e99bea74cff0200000006ff3ce43905e87fff7b48b0086f411987c6ddb948ecae5eaaa740a7e599d5db1400000007e3627a5aee4f75f777c3f878f0f2336172bbb27506c2a27b2c3f99a1fb500a0e5575fa2efd5780463b1d2253115c4ba866b5c24a1a3a56cceb1c475bdde65eb	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a3d5a058b71c4645a1a6b8b9d2c7fb4700000000020000000000106600000001000020000000720209dd703298fa9fd6a6ba9a9918aa9be5eeb56de71c754df9a0deda642276000000000e800000000200002000000059ac332e66b8d7db76bf5e548c8f1ae49daf43dcde3483e515a7df4db797541e900000002e2b1eb4e662156afa7587e2ecdb1305a9ecdb6f862951cf1e6da8852b1c2b42332685a7d0e4a5958e333cab2163d097f0bf2858841cca64766a6dc6e3c63d7d5637f5314bb78aa8699d7702f4df3fd8dcbbc8640e01d8ed919281e2b2982a044e9de77af663761079df2634878fb83e33dadcae98dcb5b87fcf9220357ab715cae8aa18a2f043c6490923e4d873603d40000000a9e37e5a9d484cf3eadece714c662d3a71022bb7468d329ac124e2758715217cee2efc286f43ef550b1dcdadb78989cdbe2b72a92cdf0b523484e6397adc4abc	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1700	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1700	iexplore.exe
1700	iexplore.exe
1616	IEXPLORE.EXE
1616	IEXPLORE.EXE
1616	IEXPLORE.EXE
1616	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1700 wrote to memory of 1616	1700	iexplore.exe	30
PID 1700 wrote to memory of 1616	1700	iexplore.exe	30
PID 1700 wrote to memory of 1616	1700	iexplore.exe	30
PID 1700 wrote to memory of 1616	1700	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\435a23f29872e1aee028d028ce071f08_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1700
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1700 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1616

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
73fe127bfab1dc3c3363208c85b7e8f5

SHA1
8dd60f12c8ddb9c1662f00b37f7ef6f30cfbba01

SHA256
43d50883a331ec158f341d0d205742c29bc557660d568d42014f0ae9d6144b82

SHA512
cc1cf8298f3fa2b680b39212f92a0cc283f9b228f61be67f0fbc62a614904ee26ff6f38d024f667675a27f6b39a12edb5b0987283abc2c0cd5c6329cebb62faa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
408811105adb461bdd1fec5afd27af4e

SHA1
36f552ba772ddd755675734d031832c3576644ca

SHA256
05154d9368da35ac2f6daf95bcdd0b34bd2e68c1101353fa969f762ccf2bacd4

SHA512
116c52c6a51737f2832e75ec0ee06f0a807469b0497f17898f075ba2fb42d72aedc8acba257fe2f908549298a2bf622492b09d8cb9b5e850dc1eb7cdd5e1d1ad

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b2441c323b4d89d21e319351c1721f48

SHA1
01bbf6e896649da661ae9767c82338bd590b9def

SHA256
c049568941bd1b4e0256295381930a3b94ef08ad6a6a4340219ad075b3eb587a

SHA512
f47b8346ee0e28bec68d11aa75a5c35c07234014bdd200efb8105abc55b1cf89f7679e289e754ef7352fa936f759484cadefbfa8033ee70c41800b0d85b90db7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0128cdbb8169e157a897eb903a61e026

SHA1
fcca700e22a1755c6f36589feea3d77d1b7a32dd

SHA256
e6c6b0ee62d0f6fbe4430c7eb5863bff19cc2d3900570a2b1155bf3f9163efa4

SHA512
08fd866225abf98fe6c8969b9196c4683dbc8f350faf17f0c9df2484bbdf0136182c95257e7679e800904f65e9d7a453a7adcedd3940eb81d47e466bff6684fc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d471179288e407d6de60224f9a79a4a4

SHA1
1f868517590fab07097e9f7b302d184d60801f11

SHA256
259abcc1d0ced00cd67646352c9c57ecab186d6268ce07789bed49d0801c8803

SHA512
bd492c44cc4059a361b2331da87806c98aa2964b768ec02e08a78b12272a0e58106ce3e1b913b0b492ef9a7d0cf4ab0c271cecf592782ccd4322299be504304d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
aec931e5104911b5ed1d248d30011579

SHA1
426cd55f31ef4bd5a813c122d9a57c85991fd072

SHA256
457a7b0f35357be7a1d79a4877a0e0967c4e60c9272cc93364d2b73633cb530e

SHA512
7f13f764ca6bc1b4c09adcd2090dfa97be54b207292d785ce598619aa246c29053c3ca03392db823b181e93406195a787b28852ad01723ac0d9397bf5f9b8e4c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8972a312d30302d03e9e505be9f1e286

SHA1
beed642f78c8165d5718d4a11d2a412529e7e915

SHA256
fb4d527e54fb53045b22a5ca7560d70c1c4ba621fae912295fede35dc949bd47

SHA512
7699b95b4812dd2e46ba420b1f46c96122a7281cc629a6d2655c70a603a46675849779b6c3c0fee6fc81a244f666672497eef564dd5e28c4d34e4939f6de8540

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b2ebe6588f04057dcb0aa67631f9522c

SHA1
765cfb00b413d81b7e52e3bab977b3b319f0ddbf

SHA256
7948514db367b3030dc526f00bb0a8d7afab9a7e8960a1226448a334654aa75e

SHA512
50fd2ad1125e7669a5eea57e7ca4a165293c8243c8fc1fe9930c9d26719371b9ff864141a88d5e4e437ebe625d1883e50916242e0518eea3404f2ec77b7f2b19

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3c83d992566d3b2be31f33d5ad33e35a

SHA1
ac8f4a47ee206a9419802b83722532ff7f70a3b9

SHA256
946be4a4f2333d6ebf6f08ad468fff92f79a63847ccb0dde9db3f85da7e6dfa6

SHA512
454e954242a57eaa94268dbe2cf4634b6997a4d8c9cb78b1c2c05686197f5590146cf4201c64499416c883e7192aaae560a5a9a00a8012b5b57b4b2b47b45b74

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3eab39798ff0383eecf73a0c3552ca77

SHA1
86a5c2a39f5f886ce187acf9fb78dbc9aae1bc99

SHA256
419219c0b680c02f761f1cb4539b742ed032b05d44ee4be8e81393a05c4045d9

SHA512
c43a0d3214d41c4216d7502c4919e58de00f42a17dd57014a6dd5df68d75084d75da9724946b3f8799f7dde9c7e4c0b5f570fb45513c77cc9ebfa587d084a487

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
57efa8d3a06dad0d7137201180cd3f8d

SHA1
72c67d278acbfbb26d1c8fb35b15f5cbbdf290ff

SHA256
2f420a3f1b4f10a9106b6f234b61b8f7eba66d5a10ea6a17c71037ef9e3c21ad

SHA512
cd1a720db84c82356f95d66208ceaecd254f5c116446e67285bc8c4d87574893668f6b16dd773fe6d329aed2ef247cad25571e21c243625906581b9b65c0ce21

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
87b2c4892f884ad4fd3ec83bf2541887

SHA1
7c0b798dc65a98c07cb4ea6f05083689caae9fb2

SHA256
ddf4f636ff8bab2c32a06d67905b91928152bd158d0da86eae72274b19b5167a

SHA512
79fdee522f799b268d39e7ddbba54a66d29fdad9c969d169e8a39db80e75b98235378a0a35e4b96a57ca1bc5bb7606ea34136b3f0a11194a596eefa0ac7a3fcd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8c25c9f5e3036023aaa60734df9eba3e

SHA1
906defb09febd3f1b4847d84578b2a95c5dc45c9

SHA256
6cd1521246ca6bbc018a039da99168b49afe34191c13dc5c27721cc689b127ca

SHA512
7867b3e829db74ab38bc31a5d12206491f39a63d17a8a0d120d023a82383406837f33ad092df4360c241301ad9a76d937657fcc2db7943420d19062a0a3cc257

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b28f7d7fb45872d651696b79323f63ae

SHA1
261f2185f06601578660b2c109a2ea3de8459575

SHA256
52f8a117290dedfc43aa6aaacb9ee8e0651bb1bdfc62d8c8b2a66d8ec306d571

SHA512
b0675e6a20126cb1c2f0c1e162a499eece47336fdf8d7ed9524bbb7c81e4678dd2dafbfe38d52dc3ae16130fc86acb6691522c046ddcfa5721e8a3df2800e48c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
08fb662471c9306ab3336b63e822c48e

SHA1
f9d71b654f05ead016d83443693b84cd45030b22

SHA256
e01fa55376a7593a7caccffc8419df44dd7c122c8a9902f02040a56a651a2d89

SHA512
c8fdfaae151463adacae294517fc170b4a98ec3582058429005f9b078d71538b705d7cdd5d6ac4b282aa6b5137bb4eacb52697f76103bac250c4dbd8ac2a8d4d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
757b206c957915d65e8663a11435db85

SHA1
ff3d906486d7d798e43ada3eb50ea818ed1cc8fe

SHA256
f9d9ebab99377786fb085efb2d4aa657f7dd39a850b99728a8b3468a6a733997

SHA512
cee8c1eef1d5e39f6c99371585e8f66d4664adb39508d142a07108e9361d1a3e2cfbb703cb0d7ed1dad333a8723972fd14a333c81573711cc02db42cb5eca0a2

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabE582.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarE621.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit