9009374139923f7d12281a38b15ddee165ee28f306cd74e0cc78ed4311e190b2

Analysis

max time kernel
120s
max time network
128s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
22/07/2024, 23:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6549b9a2c0c8e90b220f4b7db69fab52_JaffaCakes118.html
Size

13KB
MD5

6549b9a2c0c8e90b220f4b7db69fab52
SHA1

90aeda7d61251c4c7eeaac3e0256b353f3995ec5
SHA256

9009374139923f7d12281a38b15ddee165ee28f306cd74e0cc78ed4311e190b2
SHA512

7c0b5e83f27bdaa3a4af19a4882ecd3e41defca9c24d0f27fe7b0b655f2cf78d14095f63af96e8bcce1710be7631483de5d7a07925b32dd5f0aeb27a2f33a933
SSDEEP

384:+3wgXEugQtN8GrAddlFGGOhyjOtZS0oQzBbK1:ngXEbn07I

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{F90BB721-488A-11EF-86A3-DA2B18D38280} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002aec918cb9fa9248b7812ac80df2e74c000000000200000000001066000000010000200000000f3493674fc40c77b183e1aecfb64d1182c78e287ee001833993db079d6c3bdb000000000e8000000002000020000000846c1b6dca1817aa7c90f1bec42b3058677c280086f211def98a5d1e42de8822900000007b208f3dfe3262c6e1356572da6948e6c4163288f1c553f1c9751c76f3a00df0f8bb931c2712c51b8807d8778ef9a4582ce21b2b32079023487182e93cccae0536786bfa1f69cba8683b22a53bdb319e5b6e81b3cc35c21e758f18f2e643d96cda8cf509f82a3846a7a7d9643bb5c42d4cdc099111c267182b9518583f272ad022915c35dcf2d544e19db747f79d2fa6400000007b0cb860024f9b4f2bead704a72d60399f52536d4a5265a683b1b19191b42b6b5cdeafb08b048fa812a436c91014599a0f70cac994941dc61277c78589673bd4	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "427856587"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002aec918cb9fa9248b7812ac80df2e74c00000000020000000000106600000001000020000000ba96d5baf4ecfe4cd3e36dfcc1782859ef93cee0165363b2fc8a8df44009144b000000000e80000000020000200000000c05852f6f587f1f03a3bd497def878797417618cc346c85ed4986c8bb63b2a72000000066421b5b44b66303c1da9c39bda9e682e97461de22e2672d2d38ebbd7357c1c2400000004e0b28f5829aee04b13f7842f919df0bf9549fac973917b8e08432a1ef81184170b750a6e34d078ab73eceb8f33e0dc4d12423b07d10e780f09c1cc79aceb599	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = c0a91bcf97dcda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2408	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2408	iexplore.exe
2408	iexplore.exe
2384	IEXPLORE.EXE
2384	IEXPLORE.EXE
2384	IEXPLORE.EXE
2384	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2408 wrote to memory of 2384	2408	iexplore.exe	30
PID 2408 wrote to memory of 2384	2408	iexplore.exe	30
PID 2408 wrote to memory of 2384	2408	iexplore.exe	30
PID 2408 wrote to memory of 2384	2408	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\6549b9a2c0c8e90b220f4b7db69fab52_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2408
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2408 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2384

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
0f74a8dc8e3a490ed2dc53561426cb06

SHA1
f4655c7a34b77705ca71a08c6827de3e6ca25420

SHA256
b844a1fca03eb1c62c5fe2c89dc97615e88d10db0dcb90bf48182b5340501c95

SHA512
7ea2f190629a7de3ca463736f8d61f2df2aea045de068e2d435e4f5098f5e50de99743ce6ad99fdff1f0a696badbeb84dce9b51b5505214891665b238c0894dc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
05aba9cf6103cdf0a883dd16905c5562

SHA1
47a4ad1c2bf72bd7e1ab1f575a05a0c8e8febd41

SHA256
85b7caed6d9046cd10687b87a755f09b549295af02e31f6e1d6e93d2630b981d

SHA512
9b28a5d593dd287aba5a82753f74eed0bffba1f42feb176e7ccf20149eb29a61e4b2fa0f0101da783da4ec8bfd9cc528aecd7f9fefeff05c09ac09613a5bf971

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
8a909b18abe06ddba1ee4f1cc948b3bd

SHA1
66e27a719674c11a071a4169ddfc8f3fba70ce5a

SHA256
1b48582d214c32bb8630f4c1304673bf8d69646666e418aaf6c90c3cecfa23d8

SHA512
05de2db6a034868beccdc28ed89a3998a2b93193eb05934a9ed5003a2a72f480d195abcbcf13e286a65ceddb13b92e4f551934ca00ff43363cd84d95ddb60c4b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
e1fea00adad4a64d777a921a3177dcee

SHA1
0577f2fa70652e739f5c540af70d99fe40d6720c

SHA256
28a04efb1bf65bbf4f3bac5f0c7de85884b83dd79074e2bec51b40691d3bb8be

SHA512
2c379fe7f149f3d67f32860277f15228448177cdee96df55b9fdb655da8b2685aa4b874daac48a3347750c68fb73e8ae1ce863baaa0efd2139cdba22c0750244

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
4722c214e1f17a02c77af79d2c7fbb72

SHA1
b4574c59bc8ce537081749a02a396f8c131cf86f

SHA256
ba50fbd2045040b1633cbf8f73d1c60be44c19f949ad70d002f733dedcd1281d

SHA512
f7740a2605db02e222f68e1b5c87e59a8cc51db1e1ee012f6cf35cc02ce5273b0c6060f916ba56adabd898b2c09874fc4ddb58ecf05e9f5d1d644650a528413f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
a101d09ff541f3a35954994629282d37

SHA1
e0bcc2636482c7a3a2c2acf346909508f950407d

SHA256
1abf94f15538b5303a1e857c546febb4fb1c478f55b89ab905404324ef17acae

SHA512
eb984105adc83fdb29e5acc2618947b0eb3ecc2336cd0405637683e9d04236867f1edd2baa0d4c44a2a2d9fa42494cde44c91d282ab649dc3e48996899045e2d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
ef42f9c20804cd7966420a13b5b92e91

SHA1
b61e27283c471399dfcb0f4c43ee169cdfa4e7a6

SHA256
d05ccd66bf96a4554bbf843345fea310fc5ccd4dec1c5deef28616797b4dcaab

SHA512
37218d8e50c4d32ebb12ff2271840c928b91e987c0d2b4072e13dd996466bf5331f9647ffbe34a9e43e86fae4f5c7f925069bfac1f1894f88053458348ba68fc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
d1fcddb3e5c3d68d748883aac95c2a4c

SHA1
3d470eae44c9c647983376713693a4ca2bd728a5

SHA256
7f53d6ab2b9a7fa6c6c57ba344b6b34e3d7653d51ae9d71be245db90c6bbe11e

SHA512
ebaa11ce5cf18249de96ff27f85c0dfa7866a46682ab70ec91a171dcc48bf6cf5501f4f62016b2bf6060b3114310ee0131c0baef752c3a524a510ce37207079c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
fcfce63198b1beec6a9321a607cbd9c5

SHA1
8146e5f48477cd4879eaeabab464531b8857f71b

SHA256
f3a2de377638483ea5e89cc11274f9fcc2cf96df5535166f2b7d244a2a97d428

SHA512
c180ab08d6d786efb6c3a6a89d0eeda2dd667004ee78139957a0bd9e383e2e9ff8cd7a7a9385519c80d55603f01afd409c8bb62d721b684b15ba845b8fee7097

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
4030ba4a2c128d7410502857d2fad027

SHA1
2aa77ead810def0a46d3bbe6f64b075d39174f15

SHA256
0766e27ebe1b2354c8a789f3c37f9267177bd299c9ffdd74e2210df1fbc25d51

SHA512
e976c8de8a782310e45d5119618dd10f02781ab6a2c7a7337277cb47ecbbb52533409558ec509a54eca6262ac24996e36aacc132aa6cab2f6e36c75a08ee93b2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
44abb4246d2d2510d098307f23a36a96

SHA1
77adf94da76ea73cc3599e20a5117284662fc120

SHA256
76df16400476e9f7c1fb4a2653f1c97417aa9fbe3d55fa25fd79e517074cb2bd

SHA512
46c5c8ba3aefebbc829277159272e212bb0cc6f800d4ddc0ce116898897398d53c84cc0f2dfc12dc27583e71877a7c5b7981ea85b25c347d6a109c4756e6fe03

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
194bdb891edecb1b8172da11a6730678

SHA1
98df23452b83361f8a18cb3fbac1518c66d59ca8

SHA256
81f60b995938bd8098bafae686f859a3110e8961f2cb932b78756c1ca9305524

SHA512
a17d30b981cee069f83945a0d7e26035d538a1542c3709c2425f2798924866d955737a821fcc14a12e0bbcb62c1f03c046ff00d5b463db3564307445754dc747

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
5df1e3d62b26b81a19938e3b60fce4d7

SHA1
995158e8b736177f9ec7abc4d1cbf3fc36e6dfb5

SHA256
01c89b28553600eaec35ab53a0e62a05f900e1f3cab363cc059a192a57fbd763

SHA512
066766977a9b807c3ddfb491bd00d0e477ae6b7f1e326e7749304f7abfb0ca12018677ef3bf1748c35b3206f3c5eb55eebdcca3e9e70134ab4b3df23ad60ede5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
ea236ac9a76ed5863b8a039e1e4963a7

SHA1
2c5b0ec6c9195672a4fd81e2327f1e7986e2e75c

SHA256
91c0d64b5f146f0bd1f71c2feba0c25dd103fc0cf0c0a05ce453a2876b667292

SHA512
c1e98225169f9a3915d13783e09e5a3b78a596e9b96b9be1fec174d087176f9ed0d9f28f3acfc8028445ababbb5cfba3c70245f36b6b2f633688e83507e4950c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
b700113fd1374041fc51cd33db3c9333

SHA1
527b646ed6c7a2735a97d5b9fc48fcea68ab9bc0

SHA256
deeb1515d60495f372a5f52b428b7bed8a5e85ce981301a6dc824bb9321f6ed1

SHA512
983d86ddf40bdf006a12852f5a53ab26e1ff85626e978ba2324b193965ffb4e9bac82cd2cdc5b922360fee75468569bc8db9e1a54a3b4439f165c5a879a49b8a

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabD4B0.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarD55F.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit