484340ab2137f3872bc46baf85158fcc57b943421825a8d7bc5816edc3bfc198

Analysis

max time kernel
119s
max time network
128s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
22/07/2024, 13:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

634dc4d9cb271adeee5d815f333edb42_JaffaCakes118.html
Size

12KB
MD5

634dc4d9cb271adeee5d815f333edb42
SHA1

d79ddb969ebda2e999f34dd4e1228ce737d3b8db
SHA256

484340ab2137f3872bc46baf85158fcc57b943421825a8d7bc5816edc3bfc198
SHA512

d2ddb928991bd461a85135f75046b35cf0596e4c3baeb72e3943f1ddbdd1df6a5625d701568f15ac5e19c5718cd4f2a95dd8f16525f9744824ed6afeb4959685
SSDEEP

192:S2cfyP+Y9bdtEe5DuSZjBvIlNUamSPjTtThTJlzxd:S2c6P+Y3Ce9u8FvIl9lT

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000082ebb0b9d6f3f0458e93e15bd38f268f00000000020000000000106600000001000020000000f5d69ba3d13641a295aa8dceb597bada7afdcfa67ad2ec3a8ee9bbb2561d6e9c000000000e800000000200002000000041c3683283f4b631c68a223a765a08c07643348cb7b4ab13cc312aa9cbe4eed620000000bb3fd65a23aaadea82394a948821f468591ad6a3cf7ff1c1eb7250f350f9c25b40000000f6e96ca99447a6b109cb642e4b3ebda3f5d7112ee9cd1bfae512d99084e493338a8a6b0f66a4837017816d35c7a90b62e0a4c66aaba625017fbddf8bde08f594	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{3EEBBBA1-482C-11EF-99AF-7ED57E6FAC85} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = b094891739dcda01	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000082ebb0b9d6f3f0458e93e15bd38f268f000000000200000000001066000000010000200000001a1d71de6eda2ca9dcd526ad0818c3652c0b44aa483dd1cf3d39fd08501e50a0000000000e80000000020000200000001b216422c8079b04c1cfe18d6bff6a20083f1c907e81741d91fb42061c07553e900000006149e288a5639652cdba4cb5e5f493fc442879ab455bef21a86284450c114e375963bac893736dbda9a166e4b914a8edca8282924f80c0cc33c8388d3ce45523430224a8f2ae0f1cb4796a86800f5786971e6ca51751919874ca9ecb7e4339fa9b83514c0be0ec882e366a9fb7ae4122a62717b3b88b73c2dfc7b668333f04167923c48c4573056be1db94753a22971540000000319b7e4d60f7798ddc9b5e269c68a764f4b7d13e3b6386cb3b03a61fdf4b669e89512152f2b6d03befcccc360d54620d420430fc34dbfa2075c2b6a5d13abf1e	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "427815901"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2124	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2124	iexplore.exe
2124	iexplore.exe
2592	IEXPLORE.EXE
2592	IEXPLORE.EXE
2592	IEXPLORE.EXE
2592	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2124 wrote to memory of 2592	2124	iexplore.exe	30
PID 2124 wrote to memory of 2592	2124	iexplore.exe	30
PID 2124 wrote to memory of 2592	2124	iexplore.exe	30
PID 2124 wrote to memory of 2592	2124	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\634dc4d9cb271adeee5d815f333edb42_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2124
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2124 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2592

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f3c71ca048fc3abf1450f707197f411a

SHA1
3cb6dc0466053da498fcd2489e1815a7bd03202a

SHA256
3f66942a7a4a4f9ba0b090db45b1669c6e25f95bcecee2bb60f7af6860b95f28

SHA512
8a8dd5add144ed457025fcdfdd8e6438931c5505a69349be016f1134b1bc9d71a0fe8ae8b52c6f0dc35268fb3c1174df385b56f61467b417222ec7b671cc05ce

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a04dc740106fea993c1562e73d9a56fa

SHA1
daa278caa6b07fb5f2a7d2a844ad4542b4e18c8c

SHA256
8d2e797009d01ec77fce5341759dd3fbf3cd6c8018109d960f1288afe48a9257

SHA512
43d2b0084f7ce07b0f5d6ec78b46bc5e2fc46ce19334b5134a5b39aff1d84c2e9f1e9b87672374dfebcc9062e419a1130bd1ed51eec1969b8a2fdfb64b404a18

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e3ade04ca05371b0912a4d0d151d69a7

SHA1
7230d84cffb4d7abe7ac73cf09b4f28cdb6bc6e8

SHA256
8d755967935d8e4fffe3da8a5933b0228f91080c4fcf2a87bd7492b31bbbd270

SHA512
6ca3a604b6800e3bd3e3521dca8218a9486de962ac437539a199f1277e3a475bcecc3ef2454db205a39659b707ef0801785e94ec238241d17c5ab2400ccf44a5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
926c88cf3ff0d80fda0b16d89c664fc6

SHA1
6450800b5b4badd03709e2ed9ced131214cfbd9c

SHA256
0e75500a8f12c01cc40c840095e2406c4fa7b21ac1a0ef1e029a4034f9719b35

SHA512
2a6396984fc97ba731c9354efbdea7a78cc4fc029244db282d215fe8c51a5dc26e05bdcbd3371d702e742958b6d17edffcbfda3b84d83be554ca2326cd0d9ef4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a405567534f6897d9cbd0c5fe5f36e76

SHA1
2b8bf1cb6161ef116d3839ae3d1ebf8305b32964

SHA256
badb2c717f7eb5fb0a22af3b2599130adf06ff47f9918573dc8ec880b70d115e

SHA512
d92f7750ba4a336f888f6e2bdfe14a7e49bb7b018edf01965f7d1eaeb5a12cc72b13f3bf78aadc291e4048221c15dd224070223478e263cd011fe4c9b22619e4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d214a2dd4cb00ca005b2844a38e0bb0f

SHA1
cced562a8e42512400625ae5c4b152d622ec21cc

SHA256
0d88a12420ef0b812377cb06da71b76506b61d1cc9c8bb531539e69183c1189e

SHA512
c0d4995ebbdb9d1ea8d805a69f7eaf5acca9145c7ec18f9f41c46257a23efe463c4bbda230220f267f5fb943a5b31aa75042cd3e4cf907a8f0b73d2bd4fa2a62

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
bfc215e36ee6cf93d9906e2957223377

SHA1
833b65cb6f38b5942d47687bfa6e058cb4b5938a

SHA256
12d4ed05b9cb073b4a822e89a9bfb2d2613892a0902e1b1556f17e01e34ba5dc

SHA512
46ced7279497f256dc07e02daa4572673a8a48a6a05dc1c48749daa08c2d49ec1fae2923976070852b2861b30537903dafc3c734726143db9c961f77ef8ddd77

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0619e83c4e414e265f5e75ca3cb46802

SHA1
0646017200c1f5dada9821b6823e027f2376fe97

SHA256
6bd27238cd615bc05dc3edc5a939f32bebb02e9b5482bb765070ca20091bcaf3

SHA512
fe51ec417009f9cc9b9263894083d9a58a8c1ca82ac9f8ae3faa9c393a409368825bb3eec6059e619069dfe569c68134131812ff081155b98c578682b0bfcb25

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
da449640722ccfe917dfcf116110e74d

SHA1
ed38b79a5b6617287256f04f4b246f4dcd7716c1

SHA256
4cf8c1f3c95367b8204c21e726115662094d6947904f0dfb9049fd6d15be31ca

SHA512
3810eb5572c3c2527127d3db540a808d493ed511883cbfdacd6f5c60a2f5e68e87a8d88d8259f8c3680bbdbcabc33ebfdd9a4ac31730e85374dc6fcf803daa5a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3719adad150d67aa32ab86ebe8a5e0ea

SHA1
9aa42d2d35a370cc4d645e9c4d769d64eb0e2df9

SHA256
ec671e03a13f692ef24b977f87fbcbbc7b55ebdcb98fc51a0c659f2af7d64a03

SHA512
152c8cab095adaf97ae44ff9a164a553e6c37bbcfdb013417cfb1092482d8c472f1e873222254ddd907c66fa887351e26e6462780ead5388b25ce30ac53d3dc4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
51b960bf50f2c9155fb0fe448df17315

SHA1
74dc94b4676cc9c49b020c2528cffdaf5a41bd8b

SHA256
768185ffcc61f3a8931ac590df11b7f252e048f47f3cd5de9ebc280d09f358c4

SHA512
dafb3ffc243f33c2f4c12f974f1dc20b3b6d660f7f3e85b3df6c42ef9119dc9ce402ca38fb847b6e1efa410f989b874e8cad5c3454f58eddba2bfed5060775b0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9f5324eead42d90979e0826780149d7e

SHA1
91db68a6050e8d57d1bd25c2284e1ecfdd2f7e9c

SHA256
56cdf97bb57c9c7fde5c43bc3ad98b379eb049ce67a1705ce01df1976f33cfbf

SHA512
7bdae05027defebd9d6798a161d31c2d1df3402a4e98e10bb71d0a7e255b373ceeafd66b3bcebc7642da7d334310ffbd3a56a96f5cd031bb1bd9912eb3d7dbdf

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab3AC.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar1423.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit