bfd3857f013aed433a8ea742340e58fc317f5bbf223464a81138f81abeda3ff6

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
21/07/2024, 20:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

613efc830b66d33ace94ff80fa9f6519_JaffaCakes118.html
Size

2KB
MD5

613efc830b66d33ace94ff80fa9f6519
SHA1

358cc3d821f89cb9497685eec901280289259656
SHA256

bfd3857f013aed433a8ea742340e58fc317f5bbf223464a81138f81abeda3ff6
SHA512

367f6771d38d2ecaf7a85fdc92da6dfddbcbe4d48fa3b28b7a37518a944c068b66ec404ce7d728c38cc97c0524fe9ee18265ff9c5e51316076d07c6ad4695f26

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 34 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 40e276efaadbda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e337bacba951544a9a832c52e69bfb0000000000020000000000106600000001000020000000bf4b07b21e54e1dabf126a43793989591d26dfa606fd1fa459533aa1831d3454000000000e8000000002000020000000f1c68cc5d719d8b88314f9a6b743870babedb62fbdcf418dae3166fb4d39afb2900000002d2146f5f5edfb01f639dd24049993782c692b9bde902a8ddd25002042e0b22af4dc923212a306f2891f63acf4d8dfa9274b7f7d021e77f3d4cd8049006304818553674b1039077a9786db6e424b30f1ef33b4df478c4278976de4d915742056539ec49d344f65d0339cc6e090dbbb379b48ea31d3404dfebbaad957baea7ed9b697924925d7495ddb3af613a2bed33d400000000c703cc24f8c211608a6b7cc38b726c3280552a90b1fe885ed964a00d4b8386af96e69b426dfdd0a87c8a2b474c4c04fc9f915b95ec6f8ec490291e41e08425c	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{1AE64471-479E-11EF-AC29-D6FE44FD4752} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "427754860"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e337bacba951544a9a832c52e69bfb00000000000200000000001066000000010000200000007c5b809ef0bb94fec51c385158e618729a353d9e1bfac064654024c3eb7ab018000000000e8000000002000020000000d1c70b02732337931df23aad487c3dcb39540f13984bb121552dbf21c18d99b620000000822b3c2be49d50ad97bd552366e5d1aa5c3624660d42740fc35564e7df3a08a9400000007edc3853e674e545bebcc7c60d394f00ea3efb8df13f81b2ecd178d73d15edf3fd539815319d768ae045771ee00656124854734791ef360e14426d1960a4d359	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2448	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2448	iexplore.exe
2448	iexplore.exe
2644	IEXPLORE.EXE
2644	IEXPLORE.EXE
2644	IEXPLORE.EXE
2644	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2448 wrote to memory of 2644	2448	iexplore.exe	30
PID 2448 wrote to memory of 2644	2448	iexplore.exe	30
PID 2448 wrote to memory of 2644	2448	iexplore.exe	30
PID 2448 wrote to memory of 2644	2448	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\613efc830b66d33ace94ff80fa9f6519_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2448
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2448 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2644

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
797983bfdb3574f04dd1f86749abfb1c

SHA1
096c109ee66b3488e199ba88e4f3fc07bc90fb75

SHA256
0ba4fbe34b881f905817016287dbbf82ee9dbd5b42951f5b46bd84c618915a3e

SHA512
56b54c360e4f05ffd00d824587d1439adb29e4c99e87823615d61ee6131a4496f329c84efcd56352716c3d18db8b2bed3bc3bb1041efeb3217b4cdbe4591e2f1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5a13481c3966b36171261da86d0b1294

SHA1
b961f9be20d8d06fe8cdd25fbf7494ba035adb7a

SHA256
0d7f676cf4ca8bdc9084ac69ddd4afce652bc5df4adfbad2d1245f2516713958

SHA512
6a5b05b4fa169ac962adf95a957cdee02a7c0e540dca6c3b6d81d1aa4f0cd9cb5d00253431de97336622da36999f51195c54a208547f0c278ef1c854051e949f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c38e228466c73e37e99d29add7da7466

SHA1
0b0aa3336f0a009ac9c190d3efddd93d2adb535b

SHA256
58b230b3080e53ac8a5832e6238582fa6c32a1df9772c09369c9723e9cfd8443

SHA512
33965325a07102ab65b79681363f1fd4d7aef07291affa1c48f2506670e01db6bcdb641f12a7373ab45e1229ff2719d81489668168ea334de021d13a3c72119c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
373e84f129e9a2b562784a333dad0266

SHA1
fe681a723524fc3d5f6a5f1610955a96b74923ff

SHA256
14df0a734089db72d54f4cc3e88b218475d7486293af53db7b5b1130f0300952

SHA512
28b024334dad9d525a89a3160b7f11c30dc470a3e3aad20313bea833bc519ff5aa08abb0a2c5703fa29b62c058543d87abf009aca0549ff7fcf5efdebd792c0e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7039133eca9324c61af70bfe981a0091

SHA1
60be37a16ce91d8a365268b661c5b1245b7d2842

SHA256
efd351b3ddee3eaa37699e1c44c704a5bdb570667d988aaa249ecd8efccd8e54

SHA512
aa867cf5c5d67717c383a8180039e863f1ecb057ce83683658328366f13c155834de1559a29dc7e466ff007943e7407505d2276436d8d5f7ce9b9289f986d527

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ea8596106e1b1f255b06d8aee829318c

SHA1
4beb366251e135cb7a50d3c842445422c5c38583

SHA256
38cf0bddad7c80b93858ae79253b6fa07bdf7378ea51e11c7b183a08bdaadb0c

SHA512
71b562d596335ccecfd1d8bc84112bb7635a2382a954306b08129c9e550d9886ec624776c2064a7d9c061f56f663589f87349dba1789815c0704b27cade6ac64

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e7efe66a783b95a1c8cff58b56dd92d4

SHA1
a54b1461774195a88f30b856525e20dd8aef6391

SHA256
8c7298552d59371be820994efe6b823474fbaa5e32e242d90a3765c4b28a7b89

SHA512
cb8f66ae3ed04eca08df9cb647394aa861113d0261a6ec41ea903344d85ca5888300de1cce1471ad7de2f8edc2f2bb0d3d1be42d2f56d84a2e34452f2d2ad4ab

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6810598a6698155cd183277b87a09bd5

SHA1
2d69fd0d52119e7cb3cfdf1b29f356b0719a2ed1

SHA256
6c5cf5e3a2bdacddc41027e297682f712f16f86428a3f42a3cdbd57a7e6a6182

SHA512
f6b7c8db5e082d425f2a18b13fe777f27b3f101dd0d0678a965ed1908d17514eab7a3e9adfdd56e873f86ad1952a40de9ec90c0f2b49eff90da3898a46f1afbd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
092a00d6b2cc10f56d3ff9f56ab92c6f

SHA1
cd4a91f91bfabf0247c8da3fcb49536cdda29b49

SHA256
1041435aced3a6679a356febe00d4030478ecce881454cd28a54095c4cb01a69

SHA512
084df8e8be6507ce82179c43c90b944c601fcfff8a8fd4feb0fd95b13d78c1d47756f392b36709c9ecd630fe1f7f7a832d70701cfd7b1426c0a0b9683927c7fc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9d5ffe20e1a865926c249dd3b93a1bab

SHA1
57cc387f0f0a296344611948f48f4ad95f5a3869

SHA256
9cc29596c059634579a72331175a2d10b12e541d5736cd434ff54f270f71023e

SHA512
34c0db31718b0517d3e374be5203e0d3e7c74c6273701358bfbe819f6347093a789224c33ec4785fbc2c0edad4035d4d708d39b2d2356fe42ba917040fd61c15

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
dd5672b7e371e8bbc17c8bf05cdb6319

SHA1
e26645426316b4208eacf7efa23ea137def7edeb

SHA256
cdf6cae2658e27ed1b22bcdfb9aa5f05ec691c40d087d50e0c69ba0d2335d607

SHA512
f00480af8d4c323390267c337a0fb7edfc302c093d71b4c15286ef1dc56f1119158404e3253fb27841181e7cbe823923dac8a2faf311cb2c76bae68aff4b6906

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab1DE0.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar1DF2.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit