35521683e12f6de51c705206ba9b9e11b71d6766f46b1bb5ccdded5bd9e38e0c

Analysis

max time kernel
120s
max time network
135s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
15-07-2024 04:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

48220592904ae8876e261acb0c85aee1_JaffaCakes118.html
Size

6KB
MD5

48220592904ae8876e261acb0c85aee1
SHA1

d71cd3082802752cdf538da3b962fc0883d7412b
SHA256

35521683e12f6de51c705206ba9b9e11b71d6766f46b1bb5ccdded5bd9e38e0c
SHA512

5c5ba78567851c01131ea7c8b08b333fceb801427f6480e1931a4341c36e6ab2f2426205d56d5dfcddd2c33faf8e6429e8349661998cb5a7c73d9aa1f2335350
SSDEEP

96:uzVs+ux7tvLLY1k9o84d12ef7CSTU3wZcEZ7ru7f:csz7tvAYS/u0b76f

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a3d5a058b71c4645a1a6b8b9d2c7fb4700000000020000000000106600000001000020000000666899d5cf859cdef0522918c9fc2b1bc891d826d6456a5c2d14271dafd903ce000000000e800000000200002000000011d483cf39e9578c9588ee0937ebf02ee032ec5177d7b06aee41ca372fc3fe7b90000000cd2a983156981d8e618961d888c9666f602a0a10ad7bffd0ce1b5952f2a01a074393e654e08dc36e4d3229f6e86b236a501164b2891d2163ea1e83524903b68d07d3577e97221b445dec6337d056f3923bf66c4a522b0b23f77612d76ea015bd37aef9f23d8a5bb351733f43d03824ce800d542dd8ee328e496dfd0012c1a272fa37cb21d35b58316a9c8d68aa22e77a40000000c8d1150da758824e363f11099f43ecc122a33cb9aad6565ad3e2dbf62fc580c76c4937061c6793d5b01af7919e9538bd5a0d0320c69f6574d8035c00d65960b4	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = a07d6ec86bd6da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a3d5a058b71c4645a1a6b8b9d2c7fb470000000002000000000010660000000100002000000013004594204fd771fe25046d0059d1c109ccf591e29c10c64b412260d7612284000000000e8000000002000020000000fc858df051531a2f413809e339e14d633b973ec591a96d8141023373b9b23a8f200000004be98574031e819fe3e59f167fea8d0e7014e36ce80c50ea725c771adca59d9140000000e0b2ab95982dca5405a71413f246fa2472cd2ed83caf2674e99765cdeca23f5d53f9a808f1f6c244952b55e3a704f3a213230e2c71576044d0e830f11ef431a4	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{F3036621-425E-11EF-B4E2-F64010A3169C} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "427177975"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
824	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
824	iexplore.exe
824	iexplore.exe
2676	IEXPLORE.EXE
2676	IEXPLORE.EXE
2676	IEXPLORE.EXE
2676	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 824 wrote to memory of 2676	824	iexplore.exe	31
PID 824 wrote to memory of 2676	824	iexplore.exe	31
PID 824 wrote to memory of 2676	824	iexplore.exe	31
PID 824 wrote to memory of 2676	824	iexplore.exe	31

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\48220592904ae8876e261acb0c85aee1_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:824
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:824 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2676

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
bb98d605b7d7dd9048765a9732a80800

SHA1
3e11e19d90cbc99039498f7c76a07f3f66862b7d

SHA256
548ac5313e2894786c803c42d1e57c3d857818d8d1277eb15e8ad922ed346408

SHA512
a9269755486dc525a52b786b092c12c73df1f3949e192ebfb7d51243d09465591c5d652a807a9f379a5cd92001db4497e574eb033dc3c804dfa4e7efb277b1c2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f9dd300115c11113126bea7ffe814d06

SHA1
434ab5e5a91f3c80f07a9f0889d74cf1b27b4fba

SHA256
f9175ec40ad58f6a5fa683a6486fdc3b8c0f0ba924b632db65386c0e7c04ac44

SHA512
3f1d3c253a1e211f43c165d1f6b312e0bb87dd20cd2a3c6dd6c36b62220f5c8d322fcc79bbcd44e893cba628b94d76812f06c4e9a7fda1af3ab57187e58ed76a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
bddd9337e2dc3858d6bc2d5572aef274

SHA1
63ff69077b26613a60ec758d3f8949b70dd23d35

SHA256
82072c2cae9da6179924cbbfae065c099602f5d562273a70116809da1e42c347

SHA512
9afbfabc385939071894aeedebecfa90275e53d04126b2867240f48f05411eb13cb4e99e6e23d18990045be1c5b92ae34feb9e8a0941c00f551bd280b6da0cdc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
aae94b437c805bdd9c852a712105aa33

SHA1
38414178a8a089fc8c61d4fe17dd71b55816cc49

SHA256
230ed5c6028dc8035d25c4caf88496a8f951fa4d6299a1a6de182438fc481f13

SHA512
0a392f295db8ed80cbd2ce834bada5d6caff5dfe706bbdfafb64979d7da7f691d83bea4034f04111ec795258a9298e282d6c7a3686bb53140dee24e4b5ee8440

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8535df52ca8cc94f15f838998e95f1ee

SHA1
7d1d8db627267702889f30368db3e4e83fe7a3b6

SHA256
1b6b0992b9c91480dc989050f77ef2d3a110302d0ec5252afbbfad5056a22bba

SHA512
392172a865d933adc802b227e7191d0584621935f507a3c4fa09e93311b11758b42b1561dde3c4dcef001c9d167c737f7495cd0a235f75ded69bc954d26329cd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
955f978c567a3c9658ce5e7cc3312f8f

SHA1
4b039219bfcc85ad590225ecb4814cf1a32b04a9

SHA256
082a7a9e2438516911dc7910c5279d790e0fc5bde18aaf068d588e38381a70b8

SHA512
36bda2805629e753bc8f31281046366dc5e821325f72b32e39da66feb26f17d739790033d129dd59f1f326a4e8189eefc36fdd145cc235229ec27e5717cd1233

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a41757898b60b14f400dbad770301c1a

SHA1
74589735b209044a86faf39b8d78879d64e2b2e6

SHA256
1e6dba22fa746658bb09f74cbf5c54ec2573b5946d2e83dbfe82385399b77697

SHA512
bafe9a2701b09efe2239ff9b3f301fd6350c9e40cb5a2fd873d030e7c9251fa6ed125872bef58aa6c933a249ef355332a982dd8350bdc18483ed68c26046a9fc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4bdab2447fdcec4b4f27e166d014eea8

SHA1
3275d8163e4e6c4e921ce3280305f41b7910d78e

SHA256
c9f0af4ae2f1168b5bedba0418bbaff0d4c38bb115a43ae9c1373eb6ac8dbb60

SHA512
a9f300c8c9f1ab0bd5717020b27c82b62f7ac97bf1c01c4a3b456c5068b62a821b7c899bb8c67e92820cf68e344faa83ee4ea1b757ca4dba66f82cb64f580935

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4e8ca98a5d25e1d155ad79b0d8a82448

SHA1
f35345a6804d5e39ffaabf976a23cfb11e9d287e

SHA256
d35d4274c9da23b4f2e25fab763297303c14627e13953816bbee12fa8d5bc50c

SHA512
39180cd1f03e49bd101a9e9eaee200554fa73ce5e6cde6243a557ab12fe4adcd321d9e81c79f13b1e91a540daf6edb21dd22c5659066ee5a94ed30f7505ea082

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1f3620760dbdce041b2e104bf4e66a52

SHA1
4429fb84f7e41d29243c9250142f51ec888fff8c

SHA256
f3216691ac497c75377678b40fb5305558e3f013681ffca282b6d949ef2a9486

SHA512
2db1246793faab96f1f93d3bbbbf3acd97dab3a3c964c327d23a1f9d8013db53befe5cb8802234efe27890113c1c6f85d900c516127ad425f0e0f204217eda29

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
07dd91d117403c9b6b298fcba90a4010

SHA1
a3ed8fef5d463f2394377fa6f310bb471263b0ae

SHA256
bdf1d0175cbb917be012b6555ba0e7a9fa7cf87edfad9b2e4c0ed3bb6af31242

SHA512
ffad06bd0b36bb48b5ce9c64a2b13f219b14747685e9d838528cd6c0168b4d9dc9bc35859f0a78f16ac7e9ffb26b4da4853139f93eb9485185f17012764d79c9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e93d0ca75978bd2d469febedde3bddf0

SHA1
59aab81a5dc1d92e59ebee7b80c6d7f5a3219d8a

SHA256
44f4a73ffb8d704e0c9530ff5acda5f48afed6a1188f010f30067e0bbc541c65

SHA512
7095cefa694324117636dc5a9e14491cb7f8310603da7c3a3035999c0148ae98d0e26d92af8d3477e89627f44bf2843ed539030231e29f49f9c22e779a23382c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1ecc29dc6b029d87d9f30aa235449ab5

SHA1
6b2d4ac2bd73f907e44581c5e1b42d85800a88a8

SHA256
000379d3a1e4a14ffbc6d0338dc08400d945d149df687974f446ff41d803331a

SHA512
4db27a818f174c6342d975032aa47abafd27bbfda1cbefb8613e487b4d95d2a7603ac7feb901c1cf4fdd71f6c3034303a0ca848deeb145f12db6cfd69ec02df4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
63972879d10ea4a27f4296ef080df8f4

SHA1
a6522cb68fd3f2ea06916bc862d98bead82c1137

SHA256
0427b92a10f507353e940fba49266e7fa17fb44c5553617db2633115238728e0

SHA512
82ac7e87386165fd21400fa829958d38777579802d6052793bb797761d620ddfc6c204d22b02fff28689f6a55e651a183d135ca6735dbc6904f146028611e73b

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabFD94.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarFE42.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit