4919271f6c21356b077e2030646080a67baa34d4ad7a78712bfd929e15038869

Analysis

max time kernel
133s
max time network
127s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
14/07/2024, 16:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

469827120ceceff3a6fb89b176b4c1a5_JaffaCakes118.html
Size

6KB
MD5

469827120ceceff3a6fb89b176b4c1a5
SHA1

973d8556c92c3e227421e6dd0f9aa87f67ca2ae5
SHA256

4919271f6c21356b077e2030646080a67baa34d4ad7a78712bfd929e15038869
SHA512

146d8f0bd6c95b96b9ba8c10f37b6481b8942d0d649febbb25ae2ad60d24819dd782066aebc4ddff29de62b856ec7a5f9ac933f2d2694b0c6c2cfa6557fd208d
SSDEEP

96:uzVs+ux7yQLLY1k9o84d12ef7CSTUcjkcEZ7ru7f:csz7yQAYS/ib76f

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000043174f1aa2314a47aa677ebd5ad1f6c700000000020000000000106600000001000020000000c19d1fe60ba5efdcbe7528d5150307a217866044dff27cd4855466809bcec9be000000000e8000000002000020000000ac23563972378f0274245c6c2c1ca528ac771a12dd30effe7aca5b48404487082000000047a5c8b872adccd851beae4f9bb141c52726a05c4f87144ce863093bef03f70840000000cb444864315950f953b94b87b8484e262dd21343764d15d80fb6eaf586621583453b7842d8525de6ae5db3077380497d81688e85cb7bbd85ea85cba1c4da78a5	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000043174f1aa2314a47aa677ebd5ad1f6c700000000020000000000106600000001000020000000c1a961d844b2da97889db3398a93a641694ed573f0954b6ed5cacd4d47940384000000000e800000000200002000000052528eb3d3b720392915729444735b24584ffbc526df7ada5fed1029f734aec690000000528df89b59a6668ba2b30b35d93d57808338218ac98df42925d3ff567546841788fc2aaa708650845aedee207857076583f1a333b178a70d9b40a060e9da27984402e4d0ceb6fa2287748f6364c10c3f122408b675788121bcbd5609b7d43095ad0bbadf2a950b569f98de716de0592341a0c039eef9204a3b93cc78621ec63cdf19f7e0b5196eb3c51558f8b25931de40000000bb0ad03942218dfdae65be26d13a6027eee8ce53f5a481366ab203fa69121d31b4c0c5345ae74073786a4d3010c7533d0db2bbd458f0d731ab48fcaec3a496b2	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = e04611240ad6da01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "427136033"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{4D6523E1-41FD-11EF-85CF-667598992E52} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1336	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1336	iexplore.exe
1336	iexplore.exe
3064	IEXPLORE.EXE
3064	IEXPLORE.EXE
3064	IEXPLORE.EXE
3064	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1336 wrote to memory of 3064	1336	iexplore.exe	31
PID 1336 wrote to memory of 3064	1336	iexplore.exe	31
PID 1336 wrote to memory of 3064	1336	iexplore.exe	31
PID 1336 wrote to memory of 3064	1336	iexplore.exe	31

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\469827120ceceff3a6fb89b176b4c1a5_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1336
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1336 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:3064

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
987232638aae072ed66786dc82512687

SHA1
3b1f40eda83401bb9012106b03b7a8fd31c25f5c

SHA256
1a7c0112f4fb347d549980db434c7e9a7355017ff90f93620ade06d325127f5a

SHA512
928554ac5311aec9de65fab679981ad1bc01872ea3e546321c5781df0137e14ad40102ef8d98164e328e04a086f0c0011f1e20a0ac78915cbffa63f586da30c9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
345b5979657ed6d71b4040628155462d

SHA1
7faedab28e754ce07a723ab56f9d432ab8252a7b

SHA256
1b348ca4e7f6cab2baaa71ea2281a8522f8a0289b6f351ecf8ffd4cca2542be3

SHA512
ff3bbdeb9d3e778c6924a562b67e9406b54dec2279a5afea1b37618880f919662e3c41473bedd3595948209ea432edbcd8c9f35f7c1aa3f2dec2384affdba041

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5e917d736f936b5ca27731fb2e427102

SHA1
3f30111b85161cb0648408292f69d5ab80a9cb2b

SHA256
1632a0380ddd6a079079a4568b7ed1d66ae88f5a3f56ecb6a7e32d264f7d6430

SHA512
1c3edbbefe35797f531e28d48215bc935bdbc39bdf43aba53f0082e7c45b2004d2327954edc3786ae337be2bd7231e7c723ef20ee2a689e09dccf248474d1686

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
580265eb040990e2e0e79b4feaf10161

SHA1
bd92538f2fc79d5e55732efb6ee100f14c75ba37

SHA256
d4cfb4ae40f874dd7b72d88dc44f75f5ec1d52414cd2220e9c5c0cb7607e78bd

SHA512
f1a07a5af00ef835b2eb049d2e079be5b93dce5fc486fa02176492a8b19982afd39950024d9ac4377e688b79fd16a276a8388c9845d2e563b20f2bf9a4ad6280

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
271ef5a7ce4f926ea160eacf940f4920

SHA1
25daf785a44a025293d85a9fa97af4ce88750059

SHA256
0c20eab9ff5bfbf9ffc6d58c345dd0facf6e99a0e74c9a7bc243725e303627aa

SHA512
efb582b8666557f8e5349bff49ef61ffcbe145204f5a8a9fe9c9f55230f18912b12466ee7ba6270dfde99d5dc263e88cff9c231c6f72b9ee4d1042e7d446cddb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ba22b4471c222fae34b63f80db8d1d1b

SHA1
d8fffbbd2f70f8284d3b15d00ac54761036e4a35

SHA256
75a640d4b912f68d96ce659f2bd783f482ce6f67d63c67d9fb0c545b98ef3222

SHA512
894e8050331cd923d4efb0c18d40a9c3b9602bec758c830c65cc77c7102685bc19cfd536861f30b950927a56cfad8c513eb39d5f7cf2f5f9aabb484ac6925a54

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
953992174db32cd34cbcea02135cba8b

SHA1
c9310ab2bd63dab32f631f3864b74ff5627fc593

SHA256
60d5501c36da63d15bd88f5dc617eb6f2ef3080e4d35912a710efe344c9b7f29

SHA512
d36d894021fd1f4876ea0641930f2af29f13188535a0a3014ed6d0d388b3efb93d860ab26d3e913aebdb50f8941d5467c3dafed075929ae1f6ea1470dfc21693

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8d3ff17cdd84f21175b2999cb1627f3d

SHA1
70509b4165d60d0a5946c1b053b81a8ea16ebb39

SHA256
c5e720042c626e4246dbcfb9ab9485bd58bac14e21f658a0d1b20a7fe83de71f

SHA512
2661878f2f33f51b606b6b3262d8f3ab39583a4b12ec34738d0daf609ece24d966b6733b152eebc3bf6fc106b15e4f9571adf6b40e4f251fa4b2640cb91d15a4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
202f31995a7f238ec0741bdfcd65647d

SHA1
df6505d26a1e73c5cb3a0db53a04e5cb58881698

SHA256
d39cb598bbdc7483ade1240a6d44739dc6c3e4cafb975a11daa99840d49719ba

SHA512
05d0e291c3b3b43e0249010ba688b1ddcdec1c7e4e83fa25cb807fe9e4a68c43a3c9402bc970d06d75b06e876f55532279260d4b29ee1c0e1fa53b8f72d1e59f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8bb29c039a3ee3aa935550b6209d17b4

SHA1
bd90799dea708dfe835484faba259555dee2b555

SHA256
53d8cfeabfb2e77547b8c0365c8075ec3a8e9f4c9804ffb09744eb1fd00a180e

SHA512
550909e3f251d31afea6f73431ee1cdd96badf3193dcc2c69bb9517c01a037a8ce8b231bd8bfc108550450262fd31367de60b40daa7d8a02842af8e16f143d73

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5a86a88549eb7e8bbfdc50e2db4e7148

SHA1
ca556c7211fd9b46075173ff88633e5273c79640

SHA256
a2bb428992235c856290b6d74d2c13099490e8e5492c042a70b528e0b2a16c91

SHA512
5c3e8ab465668441e4ad8f6fdcd8a345859c17fef96662164aed83f68d9cecaebbe185f0acd2f1777d58ebd8d4f1f87438c8fc70faa5207ca533adc3af440a4b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1487e488171a98fa268a86e5feb74805

SHA1
03d8f4eed9d239014952059250dbdff694c926e8

SHA256
cc6c5251bc33d65b4dfbe4bc5099d1d1ff602523ba2c2efaae40accb9606c5b7

SHA512
61b21194b2fc1b0c39ffb84a358b837f2e7f16814736588b88d9fa86d65218c2c3db908777208bff5e2d7a0e064bea44c5354cc25a5cf1d85ebe51c3b3114bf8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
842339b0633f31039bd238b0cfc46f38

SHA1
df778293f735559fb592b9d798a76df7f5af3389

SHA256
c9b7aad8fa7cb6f7288d466365c335d59837c5b465dfd885b880166aae5ad2e3

SHA512
adc4f1fe733123cbd6c70243ca0637e4257312f8eb8daa6907705203f17501513c591c352eab26553a5ac9ac7719a0dd47d47053046a97816971ced9843d68e8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
62b938a6bf7705dd2b73ead6b2535bb2

SHA1
dfcdcd6c531222fed3d851efd21b6fd0f6dd4cde

SHA256
a456aad8506f9c737f155f1e0993db963818b947fa41d7384e91b9ef60795637

SHA512
b2abe1bf763b0c5cfa0a954f533275c533610e19a419d8d3434f7e3077f995a2fa1d09b6659f3959d1b807d6cca00b5461d9280a313b08396557a6bf4e338158

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b7f3b498c8a835eea124301cf19107f3

SHA1
00f8e11c3fcb0ec10850257d13e4188816941061

SHA256
8be217da577f8c1b02a9cf004cfe9e9d2b75fcde8a8f2b6eea41346ddd2bc010

SHA512
98fb8546df4639b16c0ba8c86ff7fa7580ddf686d5e3fdaaa1596aaa196438196075464f23d1f8e160a1901cb9b44d83460bf0b3ecb7372bca4d21bad30f94aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabE439.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarE45B.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit