1731f5558f7da27123f4443e899c86b848bbb35f76e0e0115a6fd4025e51dfde

Analysis

max time kernel
134s
max time network
131s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
14/07/2024, 15:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

46800d4a2841f8a15b35868dd449ddd9_JaffaCakes118.html
Size

9KB
MD5

46800d4a2841f8a15b35868dd449ddd9
SHA1

5094c668cb10980e846f48c7c6e5715afcf71e86
SHA256

1731f5558f7da27123f4443e899c86b848bbb35f76e0e0115a6fd4025e51dfde
SHA512

5d8bab573a68844f14c179b9c64cbe6fef75bea205951791761a90dbdde51d0e66d7fefdecbed181fb065ac50438d940e85341ad0b275cd960d632835876c4c2
SSDEEP

192:09rmu2XAbU82T7Zkd1Ms/7ALvp6pzpgOp2SpNxpzp+apTpzpTprpjpjpTp7pzpz0:JX8iKE7gBxxpRhxphxR5xhR5hxeYpRB0

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = f043560806d6da01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "427134274"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{33D073C1-41F9-11EF-B552-FA51B03C324C} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002f8e41e3384fa749ac47329e409d9909000000000200000000001066000000010000200000007184b9c303f5d9e3b56f2539db6d7ac5773d1b61016e777b27eb6151ee8920d7000000000e800000000200002000000033a2d828568f8f09bdc6c7cae14bbe5e0e91c722c347a511c6ca933e35940c4b20000000aefca54332e9e3dd0b77020ae666e65132f533457f4180e024d67115d9aea72b40000000c611d09256b0f20622a9b86996217306b5773ccc4f488cbcfb542d43236ff328e52923195ef645744e83b4946bc56189dc3451eb662d42ab44191daca7430f74	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002f8e41e3384fa749ac47329e409d9909000000000200000000001066000000010000200000009c304012edd28c6ac40ebd605fe18c97ac6cbe0af94e7e1c6add75c29d220e02000000000e8000000002000020000000df53ae0b9070632ec9f8b3959861a9b9387dc8038e679de8a584de5ff9bd3d179000000084f7c8246f08532ce75614aea12a4bc9c3f8f314ace27ea98632808c8e147e203d1af2aee00381ee96b7660541249990ae01e769800e7f215f566a82190c1c937dd8ec49d266cc81c87e7e94f66513f2fdb5bde3ad417e2fa993ebfcef457193b96d0bdb24133a47758ace981b1159e8590f37ba59862b7a3a583aa27a338e50f3c4a5e550aa11c9b8eff0da739efc9640000000a39206d43b3441d5177e9336404635ffe5e1ef112d3ad9673bdb4d9000c75bcd1700a3030b2318dab4a9ffe9c2cbaf096abaa7bc8206c2291ce6bb36c301a20b	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1856	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1856	iexplore.exe
1856	iexplore.exe
2808	IEXPLORE.EXE
2808	IEXPLORE.EXE
2808	IEXPLORE.EXE
2808	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1856 wrote to memory of 2808	1856	iexplore.exe	30
PID 1856 wrote to memory of 2808	1856	iexplore.exe	30
PID 1856 wrote to memory of 2808	1856	iexplore.exe	30
PID 1856 wrote to memory of 2808	1856	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\46800d4a2841f8a15b35868dd449ddd9_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1856
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1856 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2808

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c0d9a93acaf48941c90d4a3e729b8f71

SHA1
07371024dde0db685b7482a5ad4e4cb5847068d4

SHA256
dd5c4dd283c338e536497f9c34dee2c69cce989932111fda9be6ee6bbc430b4c

SHA512
4d767ac734231d1389d903ffdcb913c6da598e761a3c00c916e0117af3dd0a5399c2747ec90f933d43ecebcea87b91c3d7493ee13f879053d95127d4f9f3c1a5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4998c62412dc64d1f356c6c3d0924c02

SHA1
1ea0c2ccf20b0aa4145c1741539482081a5aadd7

SHA256
347b5b4c905f114f43c3b2302ca028ff279018c477bf864993491972295c1175

SHA512
db3454609ba5042033e85587797ab2f4b29a513f44790dfce726cdc11a34209f4c210394ab8e854b73deb6dba044bb57d167cfeb7704930cd4b9ca94b326e0ec

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4ffa56f5d968308d81707f9d31791b6a

SHA1
6292e82985a5b65c2426c864942cb3ea8a427ef6

SHA256
f498a87c07b5df278f34d951fa687c5cfdc647f14c6570a6fc9c34bf15a0367b

SHA512
5895483a6e95c635a86a105eb9580108a1d63476a003245f11a430c2f5380987eacf22b5acd0ff3cc842764747f644ea91d43b277bd1da7c1cca5d6b9cb4bc79

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6f3688c37e28e267b38869c3fa05fc26

SHA1
255a941d520efa87fd849eecb996523ed4f3357b

SHA256
c9e32366f46a79191c34c560ceffbe4cb648db2e569a4d8554dfdd851770af6a

SHA512
40952bab96e794dc40542695e1a284cf75eb65835cb373fb405233b656098bdfe1ad374869789c0062adf00974066c12c146e34ee3f760cbd78b84021fc343cd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7023d3d578737e4d9cc059c1478948b0

SHA1
a3143dd9b424b59650d3207a6ac051a8af009a21

SHA256
5d4b5b19c8802a2e362aa00df2410e5e7a3143cdca1ac0a6bb9ed64b29129d83

SHA512
525c84d535f84a4ad34d846e5c1cdd7311f872c1ccd96a01a6bfe4d7fe1991fe22c679193939b3a9e8c3bdd9cc0b7cac40772cc27be34721269d75c9ceefc563

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
018ba9de1b97be213fcacdbb3348c159

SHA1
5270f39fdd825fd6b92f8a80ad04622a6a171840

SHA256
f84e28ef1c0045c00adb6d9b2ac2989374f1ceee75e86eb16065a924f4c1ff4c

SHA512
4bd3c56d8a0527730d63ce83c630b18549ef04c28245221747f713a47ed7944a4eda9319f5b111214bb1c4b504c1f63af36bc7ec4937446b3640fe913570d33c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e5c59873077ac25c17cf67c106227c76

SHA1
eb5b3b1255a1581e3e5580f82ae54135b265c5bd

SHA256
d0d8e72f984229f2e8c07f74f1d78577c411cc26983e1953da9b6b5e4173cde3

SHA512
899b0cdccb31b73371b5d4140ac987fa877d8048af52c74ba5ac794c17f855825432f500308fa3a611c6cbd4f6671ceabad2eb993fa549ccd79e1872cbbe0a93

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f23cf09de44fe885af8689e14fcd209f

SHA1
abdf0248e9b47539867425d37b0a59dab456faa3

SHA256
dca1d8125ca30570ee2173387876d5dd18c54a44bd2938fa6938a5aa55a91d52

SHA512
55f4ad41c905c737e0665a760388984d4fc9519ad1df07a067a22a6b94ba4bdc6e996732148bf11082969e58a9c53c823aeda63068ad15780b9e480807956b1a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0a37ecffef2d00d818be3931161f98d5

SHA1
9aecd0f01fdcb138fc9ffe70a7da41bf0b2d35ed

SHA256
e78356ea6a877c7640f87c4da988ad5206c4820a59d85ea89ccebadb64c3b8c2

SHA512
8a389054008437ef12ba59439e74d5d9e4c46e5ea884797b144f21cf0dcfa108c9c806670ff08b91bee348b941a03488ad203dbaabd38701d4298047940e5fac

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
255aaeea54745c54b5e42842e7fdb881

SHA1
58476321cef3919303bf9c4e20812fc8f9092038

SHA256
5648bdaebaa8265be47bf64e5da520f9c58f8acf6f182a94a6f4f353d519e28c

SHA512
c89dcf27516421bf8dcd1441a0206db30ecba279f3a38d2c274e9ab1c2330950804819a7bfc81d17534f69a371121129ab35fbfe4c417970ad4846967eab5e72

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
eea0897620edf6a430e8116a17baf2f0

SHA1
5ca4ec4a4d4606d2a29ff2b38bf852c401f57b81

SHA256
10966fd67868336d05b4ca05af260321c583ba59517a7d0c642478f25d0535b9

SHA512
d328d8ba4dd42a267d48fe3d7f35b0577910fd019ca467100edd1dae851d8ed923b40bdbdc7ec4a594b7389ff5d7757da24b1b63d84fc92a487c86bc02a6b93b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
44913a2114b88f00da61ec3da6b82f1e

SHA1
0db51a870d924ba6c33ccb3d5cff664e874f8b0b

SHA256
33f04b62f6de1e90e28285d2fd3f440bf56cf32bc7fd8e59de04235b27334042

SHA512
0a5f96daa222f5bae6991af1735bc621a8a375b77b83065d738c1efac3fd5de71c77a0d24c2638dd6c6d68526077507fa81134707c80dbe822d21c4316cd5a19

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
453c04e511739b4878f1f4d68a91df34

SHA1
5fa033408ed8425241b2c761320cba07c4013376

SHA256
010a85a4b88c701649d03b5a1a54a1d86220965a31a24107d174ceea590b32eb

SHA512
005c3c4047d0ee0ad7529961d65b879c0bfe2b57dfc4dcd11d24ae9feafb63f615952b466eefd8339a96cfb88e5d42166e9a1683916bd760e072331b13d48336

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab54C7.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar56BE.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit