d4defac3d44a4f0120bdb56e47321c1847f6ee547b982d569e27ed2535a621a9

Analysis

max time kernel
143s
max time network
149s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
19/07/2024, 22:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5e0816f7b559a20ad74f70ee74bd7259_JaffaCakes118.html
Size

58KB
MD5

5e0816f7b559a20ad74f70ee74bd7259
SHA1

0b0bddf2329d8c6b6a52980e41656502382f7cb5
SHA256

d4defac3d44a4f0120bdb56e47321c1847f6ee547b982d569e27ed2535a621a9
SHA512

fabeff30ba0a1a2bfc441b573b16d90a6115f3a61be6785af6163e6555521681d6579d362abe6df4435125abae5bf4e70ed641ddde6ef96d965c2b8bbdd2f78e
SSDEEP

1536:gQZBCCOdb0IxCqVnzfDfsf3f7fsfSfVfmfjfsfYfAf3fafifzfSfyfzf1fBf+fML:gk2t0IxJbkPzkKNebUwYvCaLaK7tJWUL

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "427591742"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e337bacba951544a9a832c52e69bfb000000000002000000000010660000000100002000000094afb0fc654560b0076cd02b4250de38ad076b36a28b0d722d603bdcadf2e993000000000e8000000002000020000000227292dc82891f87a056c9809d86507f669cecd95aacbe10be11c12c1d34310090000000f0b8d2ccd24323e6454a198d48ede0b34e248e7118e2257df8aefffa3b6280317970721ac8637a6f61adc11a9c68a90428c8af484fdb8aee9de9bed6d77b0d965125d148496819452f17b46db1377663a4d5dba8d4b35e137770bc3c2ab5b45e8a155007eb94a2fe45bd3d96742da3d4dc644d9fb192fac4bb6a129c5d5d386a49703b36378040a7eee46d42be309bc74000000012a93e9f5d6b9ba1a96cd715348a9f8aea1c52e90b50cd6ac271a30d7d6f7f5e71d7e6eaa2432693f9cba80f32c7e97186478c9f152c20316804d8a6c4c1b6dc	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 4002882c2fdada01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{552623D1-4622-11EF-9CBD-4625F4E6DDF6} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e337bacba951544a9a832c52e69bfb0000000000020000000000106600000001000020000000cc892885160bd450c73d994adb53cab51b8af6fbc570eeeac88662ce2cda52df000000000e8000000002000020000000618b8434b043cb0dddde0416365f6f3eb2fb70d3e4f87715dc0833a954d4df4520000000847278b3e0d58511f6df8224bd6f2c73dfc4f03c4e9f94d87619e62f69cd91bd400000008cb4c81443c598501accfb6ce42aefdd21002ae7961640e5c986cc2a12be7131edb0ad74d8d15cf9cd0a78f938bf59d87d1d5b18cdd4f16e0f2ca50cc426872e	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1628	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1628	iexplore.exe
1628	iexplore.exe
2688	IEXPLORE.EXE
2688	IEXPLORE.EXE
2688	IEXPLORE.EXE
2688	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1628 wrote to memory of 2688	1628	iexplore.exe	30
PID 1628 wrote to memory of 2688	1628	iexplore.exe	30
PID 1628 wrote to memory of 2688	1628	iexplore.exe	30
PID 1628 wrote to memory of 2688	1628	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\5e0816f7b559a20ad74f70ee74bd7259_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1628
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1628 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2688

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
fce3dbdd3deb86e38a998064ff59e703

SHA1
091adc9115dfbe993409adfd52cf93d9da86fe0d

SHA256
6c624837e3449f63591733ad13a5bd59dcd87ec175653dd57e544d5ae9803997

SHA512
dbcc925e888f3d86ccc22eb73b03e03fc070bd3cbe546c1737843154b22bef833adca65349b41ebc8403ea9c1033c3aa1f56734a162b8db880b6179141e22abb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e0f457cfffa6d4f170dc18bdcf646f5d

SHA1
93ac716755c36fd7f6dcc63df9088b20aa125141

SHA256
dde93367716d4a28624124c1ae86c45fe1638a996a8a439a8dfb0ecc31140bcd

SHA512
686d7921997dd0e30e8acebcbf2b033be921279375f3b7400479f9ed110424eb5318350b589310507ca53caa5db6a22fbff95a0f4549cff9ebb10964b3b4eddb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c167dacb02c4a5fb618742b86583d453

SHA1
ba47a1fd3afda4e47249628836397c2bc52829f1

SHA256
a4adec9a0668166cc5073636e70c8e3433e726b26e3c5c2abe15adba0f681d67

SHA512
c0fa7582d13d31abe9d8a133cb552222863e9010fc3fd7241532bd25ac7f6d6e507533bccff174a7e8b0a2e514b407ab01516eaeb166a42d22aa923e4048abc8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
130ce32cbafe5c85e7a135cf77bf15a5

SHA1
0239f98662561de80a458e98c2dad2b4b77ddd62

SHA256
a1402c54a2f218fc745e98fbbba4df1b98b9619711e291986c5c86fa552d55e2

SHA512
2797a70c9ab08349451814e90bcba1afb443308d60500b500254b907ddcb7c8a7166e635a15f75bb912695c650d1dfff2f28e5f36aeebd3321b67dd81f31684c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5fbafe291801ceeb6e219baadaee09b7

SHA1
0dd4d97edda0e4ccbcceb082a78f6b58a373d877

SHA256
84254b8907485816e901f1ad0b019633eed5d43a830a2413f05ebd874397b8f6

SHA512
4ab83e49dbddfe7c611445bdd0f87ba09ba4eee6d786c1dccd6db95ed7988153fb4d481701765a7ac222f13028cc01d9368d1d9fde45b9969b4abf5ffa69173d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
63bd85ebdec7446a80debe0a863bf8c0

SHA1
d285f4ffb2aeb8af53d43b29ff429bb3f88ac202

SHA256
2767aadba586efbb8d6e49c4827ca0359461891362b801e01d44162e9ce1d496

SHA512
3815044e2864b0847689c4def6cd01c32b5e8d4df49251246e0d7bb5238f1dabf198c99653b115f1bce96b3b657d69f42c113e18f2f7c8d33b9abded66b34625

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
706b24b781fd159ace2648e08247a38c

SHA1
fdca9b737db76b606970ec8b37909118b70afde6

SHA256
e5eb15dc667c3de91c96ebcd72eb92a1d7bf0692a162381d1b2ac3e4c72954be

SHA512
fed70ad467a5a4b8260af4f7c85875d6d3ab0b6a3b26ef77a8e8a65b434ea8611c283db013a1fbc07283505c90be5d27c1862811c1c0e7f402ee616a54986516

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b0217b8056cf16fefe32ac9195147119

SHA1
7f6c6e18f8d114d3410aa3f6b7b213bec4c1a20a

SHA256
b6ac9eaf75f77531ef35fa82d9bb7a0b3af147f024736f63a520ae6ab3940190

SHA512
ce22d29ca79aabf43730bdd3a01dda17161081f3eb932f9b6e00f122a5f88b8698f15c12d489c436f3c5bd71c7d3c4f9012aa422af230ccfa24e2e1117fe0aac

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2569692bee14c42fcd77db3659299fa4

SHA1
28b9a51c4d90c1c751e3d1e0ca1b7d820badec43

SHA256
da1862bdc741d95b2c9eb6b965c9cd5805e466b59ac8a00acbcf3f483cf0b5a2

SHA512
9a8486093a9114d266829ff5a0fe520ac4f147464edc894da61cbb65afec87cdbea1d4813223440563ac53feec600628b110b27b89dd51278ebd1c84bc914143

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2427e96dcc639688bc218d78ea69c3c9

SHA1
cd7b950b2c7b2dc338ac8320b86439f7e660b951

SHA256
ebc154444969487f6aafd2a4f0d4094430158fd1027b7f638bd3044752b987a3

SHA512
d348204c5d0d3d5ffbdbfc575341c8f5b7b08b4b03a120ed1eef76620814aa8205266f09380efc7a1d3e34de5a6c191213967aa13838dd54eff6f67f5596dbe9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9bb929e8571518f235312ec348a4560f

SHA1
a745e7228af94a2138fa0b9823b9272c339c5934

SHA256
1843e59d1416363e075fbdef59897e2743e4bbdc94440f7962f8939e593d11ac

SHA512
75d66d46450854c5af10507b9adc504004829f98e051cad2c76220a544625d247f6eb05d4bb368c5261b110e57af96b20ae6004341c59ff2b5c86d64abb8b9e3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f6ba4058fd9a080a1ca946c923d4a372

SHA1
dfbbc0e10e504c1a2f717878fcd8d904fe601878

SHA256
de5f92fb0fa79b6d83501b518bd3270592cb6d0d0e877e947025c4421fff36f0

SHA512
95bbf2387e01678a7edf9e02a54aa92d2ea8f06c2cc12ee8087d443ae8c8e7f4f3b135f8884b39930a43db783d221fc043560afd78e4b54c5ee8ef528c491be2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
66c3ec4743fef726a5186a5fc4eababe

SHA1
8177b5a6dc896a0727780086d7379cefd8b21150

SHA256
e3d6ad89b765c6370b6b7ff520f8ff43e64b3cde0063b5b70c30728be3a8d63c

SHA512
6443a356212321f8170d66dba16e6d48a29cb13c1f39dbbc7869266e9a7bece71b4a3e6d0f220ce9ba14f2bd37f7a9c2a7ecf852ac1b882a83fc455c28177f78

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab2FCA.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar2FCB.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit