18b94d6df583077bc5194007ce2c95a6764f884460e02715bc98670b4bf849d7

Analysis

max time kernel
141s
max time network
143s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
19/07/2024, 20:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5d97e586e416dd6d46389cf35fe9f973_JaffaCakes118.html
Size

37KB
MD5

5d97e586e416dd6d46389cf35fe9f973
SHA1

0311669baf237def079b15dbfe3adda106445ea9
SHA256

18b94d6df583077bc5194007ce2c95a6764f884460e02715bc98670b4bf849d7
SHA512

6adef6ae66a2315061cfbd9171a23e29fc21b3cb343ae5930651420c73a01da65535efe47c064d379b63b4537d39dda1d371780fcb289a7be2335af0a61d2aab
SSDEEP

384:/ZIfpgQ3QFSqhf/vPWinbq2BQ8WkYm4S8X6sVWvi0WMsecQQiICW5BPxbmVkWE0K:/ZICoeQfCW5BPJmVkh

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a3d5a058b71c4645a1a6b8b9d2c7fb4700000000020000000000106600000001000020000000a5326e0e37a1cebb5f658497e65194544485e38db4c57a0d0dfad4360b86fc47000000000e800000000200002000000049eefc9b460ef6376b72b730285f02fee9a4d9932db4b19a26f261776c118c5090000000aca0c379fb71aa88e13c02c05dfee5da059b6363117fa071231ec27f8563a3b38bf244f218b1c92886b8ae3fb907730580124e7d047f0496c0ca4e102df25c1843350176b516a5ca5e9102c13ad06c699302143f53bb70025d6434e63c52791688f253714889529c6823a6ce9949b5fceb4110402532a9f2241129026f04fa06591a9e0f3b0a2fd223f340aef6286fba4000000070d516cfc08f3224aa82c5f36ff4cdc0c0d72b182b69c5e7db1781be22b9bc79b42307c0c152b22773131cf9c35415372d9a140ada230664c7ae98782c4cacc1	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a3d5a058b71c4645a1a6b8b9d2c7fb4700000000020000000000106600000001000020000000f7a746b8bbed9c2fd1483fe4f8dcd99ac1d26e421c0d7c7f99059f5bdc12ec46000000000e8000000002000020000000547763595e8082116087931112235ee37e5a4c5b6cb7feb371d26340e8f5d3e7200000006357fcca7ea34695c6c0122c142d82984209f3685a4a4d923fb1b8c87a4a99704000000017c663deafd532373d8c0d57535f1661d756c7b290cfba93589bf3517dc12ddc95a475d58d233b2298d6c2b4452db0ce9bba55f7cd8e7a4b113c3db989a10fdb	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{9FE3D101-460F-11EF-B4E2-F64010A3169C} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "427583709"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = f0bd2e911cdada01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2860	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2860	iexplore.exe
2860	iexplore.exe
2716	IEXPLORE.EXE
2716	IEXPLORE.EXE
2716	IEXPLORE.EXE
2716	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2860 wrote to memory of 2716	2860	iexplore.exe	31
PID 2860 wrote to memory of 2716	2860	iexplore.exe	31
PID 2860 wrote to memory of 2716	2860	iexplore.exe	31
PID 2860 wrote to memory of 2716	2860	iexplore.exe	31

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\5d97e586e416dd6d46389cf35fe9f973_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2860
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2860 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2716

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3b7cd35662ea21d3a62c0bb6bc2cdfb2

SHA1
f49b2b4654230b020da1be563a1eaca939751adb

SHA256
02e936e0fe60b3aa0e47e2ed43e2e7b8d325197fe037e87bd8d413c3a08a79df

SHA512
aede1f28d7c0aa4f21cab6a1a026a05846bf9b812eb326036193bf79e68965cfbcd06be9a5cffd37dd52cf0b0006a19d2bb49bc583916c7822956abf6353c63e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
040d419a4b9eeed2c732fc0e97bac7fa

SHA1
9b1c0d2d469216c36d808416daec041ef77c68b7

SHA256
340fd1fb066dab9998490120a7ff9552223a6724bdf7b2111e8c5e82c0e07ce4

SHA512
55ec7b852963629619d68297b06a175238936aa4f058092c2d1e84386bfa9a0529cb7189dc97810dc4576313b86a99ed551589254321f75d6a0a707f7af77813

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2b029d4762fe179023bf8e7903804885

SHA1
68bf7502262b4b456e7349db1cb2397430384bd1

SHA256
5500e47a03a4b7818a0f7edf2f30ca2b848d1970ef5ef725492ec595d01069a5

SHA512
128f73851a1b4a63e19fba3fc16802a2e3c2d9954007045a7fa870e55625304abd01a6bc988c216028df24c3115e5d6af35ce53e42336e1aa41f09335a2aeeee

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
11e39cbf237f57e8acbb4b96771564e5

SHA1
2085ae1b6083c21653f3985f9fb16ec3cfe900ff

SHA256
9a60d3a5eefa67a5b9b9f5b3d867305bd4c69b716f2e8672fb119fe1f2442a60

SHA512
2a489a4f6c781e6e56f8ec17d4e764bbbcffa0a2efeb42afffbe050ea6b3bf8b531e696ae484bfb7ad396fdae0a381484902be50326f20cd9677d4744e93429f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
57f0264a232ad72481a8ae09b5b80303

SHA1
a06b69f87c74ec08b41f5cbfc9993b9563282db6

SHA256
283bd4791fe23dd8ac3bcc02e52b7fdf54722c64f048dbfc55bfd2ed347671f4

SHA512
4bde2491a55d04704827c8570cc1cf22d0b94be06f263e9a4d2ef7f64882368ad83cf0bdfa33cf9e15d0fced78daf06d18c2d9cab6cd56d5e3e99a878f7fe9da

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
960fb0618ce6efe8938061a16b8306e6

SHA1
95b8af1e765100ca4d2422f0fbb081cb5ac77ec1

SHA256
d66862efc8d6aa75c5a6ffbc75fc226aeab0c6b5155af4cc6661e4f4f13cdbf6

SHA512
c56d4d51585383d47539cc7d192efbee9e6e38653a40dc72faac2afbcdf0009205dc8914f5906a9aa58c6051a8cebfd1296ab51b34c5334456fa1527a96a83e8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f75068388ae4f98e29688ce1e8cf6f0f

SHA1
21c6da0d6675b82021151b6273078ce90328021e

SHA256
d9c70bb2fd76ac59fcd158dbe2acc59a657139dcfc2d0c8ee9ba2c2b4aad9881

SHA512
8c6d8bf54502ce1910b4334cbfb6411a8f52eb088e494676de2a7fe4bab3aa6cc291da81d5d2e971f0d403eab2545a062cd3ff6f38e133604d52ca78d6272207

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b78d9e9c9e08ee7e884ee9fbff20e14c

SHA1
bcc8f7bf0e78176a8d9130d29a103ac755a2de94

SHA256
b510fb58e089a6af25c3f41f02a92400cf2e15286914a6ff27cc79d755e226ee

SHA512
831b479f6765c71b479de723ada8b59b1247c7046d9adec8cbac6be33bcdc1bd759c66ffdd4ef26bfaba2e0e93e1f4d7d769974db4e981a1d00dc6ed4ac62be8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c3dda1ac4242a171c5de39b9ba9be864

SHA1
ff927ccced5b8f61f92f70692c22fdd779a355a7

SHA256
432cb3a2c4be6c2c129d3073f885b74cdd53f2706464ac49c1641f2eac11f2c1

SHA512
e33d7cbc06e758076df80da0c97a2596e04b84bdac28c9220f4e9ab309437b4cfc1d8155e4c4b308e90d51b3855f2da69c708339ec10b7bbbd84199cacce4dc8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5ee1b9f1ac76537c661340221ae93939

SHA1
ffb1b57c70280bfad9048cd654625d82e9a3e4c7

SHA256
4ba0a578f66ce10c2f5df4fa705aa1b2c11b30b36613addbd9a00b9554227681

SHA512
0d195cd16e447a74c2cd346b477c0c704029049a85a4353dc9d6301c4b984be8ee44387459fd58e82f3ce386a1387a2a307216866641256bad9ae5d7c662b9f3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1cf6bb975cc113144e152e87bde5b0b7

SHA1
def12bfbcd16f55bada7b60810f912c5e1110125

SHA256
f2372b3a8f8009769f7f1179f21e99c3c6bbc5d62508640ce0f47633cb4d9681

SHA512
587fc4a82adb916cd382d1087c79c38f338538a7672b869a01af82a4242b62218b076921d1e999c747bfce56bc6c7035f3321c749509f1e98e8f5becdbec7d87

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabB414.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarB503.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit