9665294a1365c45885b529ceaa54ff8fe4166ae14be8ccf2a41b4b6614e6c044

Analysis

max time kernel
121s
max time network
126s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
16/07/2024, 05:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

4cf4c1504cda203968d1f244be183b22_JaffaCakes118.html
Size

6KB
MD5

4cf4c1504cda203968d1f244be183b22
SHA1

2f53ff714d6dcdf94bd4edecb05cd20a4befd989
SHA256

9665294a1365c45885b529ceaa54ff8fe4166ae14be8ccf2a41b4b6614e6c044
SHA512

73ea629d1d475deda0e08bccfa61d0707c71c2f015d0e95088a66708455e88886b0cdbd482d46c3e108cead12e53b2b578d20b46c1792e293e0e97f43ddc638f
SSDEEP

96:uzVs+ux7IHLLY1k9o84d12ef7CSTUTdOZncWZ7ru7f:csz7IHAYS/rnD76f

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{549C20F1-4333-11EF-B19F-6A8D92A4B8D0} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000043174f1aa2314a47aa677ebd5ad1f6c700000000020000000000106600000001000020000000518178f8acdeab13a9c0fa79f63812c61a8fc5ebd32110bae8274a12e309962c000000000e8000000002000020000000ac9ab15b64bc97c7b7ecef213cbe890792580e22a21437479217243402414616900000009a95b33732cc3bf5225eb377107f6dfc7562937734ef50f2eab5d594f0223b826798e6b6689e2e9a23bb02a4056bd07524808fb96fd07c7ee2a04cdff164c71562e45d1fecabaf3cb8b68d00e0c884676984edad0948b8ccd57fa7cabc51bed7750864cffab33abf5e29383136ca3222da1ac1028b03ef65323af2ad235b6212890e2a19c94cfcdbeab6d74dfe33b3e1400000001b6118823b4085845fe42c0d2ad77feefeb19eb7513833c79a218f118bf0fd0a306e7c6c396d59f17e6b6da43d333e682a23e19b0abaf82ad8802f02344a234d	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "427269208"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 30d0aa2940d7da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000043174f1aa2314a47aa677ebd5ad1f6c700000000020000000000106600000001000020000000c139ac66aa1d26737b58a5f0660e3833628ebd5a4ef5b8a0e9f8dbb57f8c7d88000000000e8000000002000020000000ae5f1c45864774f03cca929c370558cb8ac0893c9b67e83c8f9f97a79bef800620000000e2ba933969471cbce0f1d6a7a648f3d804d0dafd63b9c62fd5edc0231742c630400000009d6debb18d9cc2f2c9baefb877661f654f8c6ed42509def168e74a1b8428c75f724af2b5672343baf6666ff93a482744d68f2e116ff21910bd970a93f9ba800f	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2472	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2472	iexplore.exe
2472	iexplore.exe
2888	IEXPLORE.EXE
2888	IEXPLORE.EXE
2888	IEXPLORE.EXE
2888	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2472 wrote to memory of 2888	2472	iexplore.exe	30
PID 2472 wrote to memory of 2888	2472	iexplore.exe	30
PID 2472 wrote to memory of 2888	2472	iexplore.exe	30
PID 2472 wrote to memory of 2888	2472	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\4cf4c1504cda203968d1f244be183b22_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2472
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2472 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2888

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
eea46170923e6ddd2a7d8c77b340771e

SHA1
e848cc0e7d76a739ab97730c277a74e7d76687f1

SHA256
359fb69d5152522e2e20c276b250a2f4b97c6a8c58e4b529d56f321266c28de6

SHA512
c530061b5274f38b290373dbc402e17b9161001dae3d1fe03b42593870d23e60d90b36590dbbd8221f38a651d5d2c766ef9b3b759d0713bdf9be326afcdadb14

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f6b5733eb9165c6966c569a8da6efda2

SHA1
7b7a3853bf7c4dd08f435fc9ecc10a1c510b30a2

SHA256
0ebd6342ce6e9a8198789a3c8f7b0d0e87493979a4284f1ed58d6546e41d0e77

SHA512
c0cf21f6924803071d87e304aea95276ebaed66787d40f6c48ea3781910b913fd2b47a499a5656434eba1662bf0f76daa44c3985e129f2beb6231b7caaf69cf7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
48297b76f0ac3318ed6e673d6c2c3797

SHA1
221700cbe78f25927181b0596ecc2ff20c00b7a1

SHA256
37a97870dc92bee7b46079287af8b2b77dc7d0eab8ec0be5d75981e92407c9ac

SHA512
ecf29d9f6716000033d89c7da8a34f225c6bcf5eb4ec0a38a89a752ec10ed726cef982c87bc7f241c58acffa6889f6ffcf248960b45e7d14f486f113bbc27115

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
60801dded6371c2c999db41f5b9b7e5b

SHA1
0877be1049248a4f19d10cceb672ec9268b5baf8

SHA256
f3d1ac075b4fdc9c858d47b0cb087e0ae6988e612fef53e6443f24c2d2b104eb

SHA512
bbafc01f6e7dc661cc4fcb3cb4a8bc6916c54b36c61b2efe679e975a4a33b31b4ca3cc62a307287c897b4ae573c6a63cdb6bcb65c67a2d82ddfae7852e05c3a3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3e5dc0fd181ffd0344a2f7061d057b5d

SHA1
fd50d2b5e57c43af543a9cfed74d90df42dac4c6

SHA256
e6f444ac8a1ba5429ae89d2956e79d17dc621949f200895a2b4c0beddc24d4a2

SHA512
f585d039c454d1ba5abd0b8b9ab9de820ab3d8e7ac872046aba0622e2f7ea32ebcec13223b5d07048cf6320617235d6556cde36f3f9648d3c0dd03a9f8bb2c70

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
dfbaef25a4a4abc5caf9504032f87517

SHA1
f58ce2925e802ac3f56e1c4b3d73ba538f87d0ac

SHA256
14010f4b25ebf1899af0e5124a048a17ba4497d245443d49c59d298108420dd6

SHA512
5904b4815523224861f05a447677f974a3faf1bff068750f70a910c6c4927712f894b73ea41e7af624c8407f8b94bf1e10063716ff0b86dffa42565e77b4909c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a235e8caebcbf7970764572bd6eedc34

SHA1
29a6813d285a7d0953944793bac2355236f4d548

SHA256
f7bd57324ffc3695fa2199d5d9d9bad77e7bc0792e51088407060bafc42931be

SHA512
32e188b7f8decbb440747e77492c89a5733845795f010133fc700b8c945fccd7f38500fcbf4e905f22b306565b7075d97108933727bc8b9e0c49bc030ef21559

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9622b9f818cc27cf2def95513d75e2f9

SHA1
55578e044099c196530f2da7fe69f9d2bc97d25a

SHA256
80d9075ff78c780f3e37f6955dbbd4d3aab4bc149d4f883678b9accfa0c9fe3c

SHA512
812b2f3b81aed06c8a01f0a4386a61964b9f541b4752d6498ca2cf4dd1c9eca0dfc988542daa835595986ad66da6d31244ab580ba0cf33cf16f9359251cbf60b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
17e46d4a26e78e409e04142fec10d8e7

SHA1
17d1ace965ce1bd163bcf7a18a38e5865ee8804e

SHA256
e11707a5480d70c866462f45e94fab41b512d18173caa7d9fd0d484e61041b3c

SHA512
f8d88571759f09ea0d6a6b2fd76557bfc737aad287645ce266e6015e4cf8a6a45cbb26f9ef5e6b2ecd919d91c697a3e20b3d5c67587664c352147e0bb04ccaab

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ce11830ec4597fd2d527eb7b8a32c6e5

SHA1
f0d820ecc8dca3c75152645dcd88b946157746c0

SHA256
b953c139e470a6ad5b011866a2da10624f9029259c56c6b4b7848596cc44f40b

SHA512
ce3ab45b6995eac7e09f84d0a6ea684d3ec248b90f1e4dcb32bd09d2f3ad2d4f3974d4ffddc328a1721c45e562eabbc5331de072a517e821f2fcc1c341393e49

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
856deafbcabc243c201e0872ffaa49b4

SHA1
38383889b1e98a422f42f132c4e42a70a50fb611

SHA256
b8bbd11970d53f18a7288b3fc21d49715ede737ac74cf67c58cf1f8055eb2c2f

SHA512
272882a3f153dfeca2cbd1958148723c93a3fd89f89d20ef1a41062c612593e4ff6e532577ccef4b46f1aa764ebd28054dbaeb984493c1fe97f1bcd1ff5113bc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3c870271c16e85fc4b79a953ae0305c6

SHA1
f690649e18bc55380ed83f6c9d6032229a72a5ff

SHA256
e48bf06b0b5254ba6274027915be25978491b38c4234a6a40eff63845a024c21

SHA512
71f892cd67b8eeb99c8a6104606f9fd405dde57ce0c4e52b87701e2469b1257e35e307bec7a951f9498034b8419348e25f2ff9be7c846720f6e96627546807a3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
baaa4cc48dcb67db5c8eaf6757ed8449

SHA1
2ad92e145ffc59c87ee16a0d7041922c1d1bc095

SHA256
4b1d4ae8773f660f5f145265ec1e7a72a28021f0c737e157164b84e2a6159e59

SHA512
fd9882fd861ef5577c3d21089d2adab4b5a38638d7cf1f60273588969623d69694dec21fda3a7e3d0ca038fcae30fc0d2e4877ae70bbb53a49ea5866efc54faa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab6200.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar6280.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit