16e85af9aea3cb991e26e009afb282f4dd406a514f3c68523b3b9514465b1855

Analysis

max time kernel
117s
max time network
127s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
22-07-2024 15:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

63c67cad3bbd44629eb13d484c0211ac_JaffaCakes118.html
Size

680B
MD5

63c67cad3bbd44629eb13d484c0211ac
SHA1

43617c4879b38b3757849e72d8a26f289d9e5890
SHA256

16e85af9aea3cb991e26e009afb282f4dd406a514f3c68523b3b9514465b1855
SHA512

cd154eb89e08c962488b0ca91226b8b49e092d9bdc0e8253706c43ae2498b66404b3d8398c7c3ebf42aa668d4000409b2bdbbe33d597fd0d8a8c8a022930c235

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "427825131"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000062974e5b5f804e45b98349be16bffb78000000000200000000001066000000010000200000007b853f1fc58c4912b4c8c5e96315c1dcb6d005094118474b28e272805345ba3e000000000e8000000002000020000000798a405822b7e6e435459e3ca675f859f8d83a14c737bdec35f8d4b3fac94e7e200000008709bb9632010aad131b190bfbad9c4bb4d8595c244862502b87519aea025dca40000000768f4a52fc99e7ce368d3b8fc1eeb636062fc3a3bbcc1a4d7c791833b62cc0ba25790f4b90e23a284d31f653cc9bef2231c4f61c350c278bf748f6d6d47f0964	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000062974e5b5f804e45b98349be16bffb7800000000020000000000106600000001000020000000c5bb33ec4e19b37dc7a0d010c5e282f9abd94fe1258be3a747031a707486e939000000000e8000000002000020000000a9ec8d1f24762b546bcfe5ca5b99db765a4d42d2575b81766d3a93479e77392a900000003ef3f6af13be2b71bca072616e8cac982eade58eee1017235addf69581e98a5e3600788a885cf4d79c921264cb089c42937f78b341e775455fa1d9dac15ab855abb68b1a03996fb50f9b8531f1a1ae693c27ca88b287180abb2d0464827611abb6708d71f794a05311dbedc1c54daa166b8771bfebeb6912c7d90d812269bddccfb5e523ceb20f7c8e8cf9af66d76f2b400000009aef1a9299dad962e23542c329ca07dcfd534e7d2ec4ae824a270e9b2a0a473824f2c39adcad704919533c77428fcfa78d1c50d6dec42bb9e4e12b1ca0e6ba8d	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{BBDD2851-4841-11EF-A029-6AE4CEDF004B} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 101d59904edcda01	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2624	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2624	iexplore.exe
2624	iexplore.exe
2180	IEXPLORE.EXE
2180	IEXPLORE.EXE
2180	IEXPLORE.EXE
2180	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2624 wrote to memory of 2180	2624	iexplore.exe	31
PID 2624 wrote to memory of 2180	2624	iexplore.exe	31
PID 2624 wrote to memory of 2180	2624	iexplore.exe	31
PID 2624 wrote to memory of 2180	2624	iexplore.exe	31

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\63c67cad3bbd44629eb13d484c0211ac_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2624
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2624 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2180

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
38968c6ec2c6cc96e414a4e1e4c001a7

SHA1
1d30ab2ee612cfb459236be7baccb054de66d290

SHA256
af539d045856d1023c9711e88105c7532221f3fe111c7ce5d20f2c4e852fdcc7

SHA512
767467a899533b8c7ea7e29f2a7b8d1a73482e912d75c0fb41b92294a93c4300559d61d38b8d2aae5c216408cb6c07d47c4e033759871c9ac18a1d51bdbb1372

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
43d2c0213d4cee8f6d43fe1221b6c224

SHA1
d728e3d2d658c246bd54943156b7da28d2ce3d74

SHA256
625dff4c9f6a1c0e57fc4990b0426a3d246272e958efb5fcd78c9d0969914b1c

SHA512
123447aa26838d438d2574574c56dbd251c2061b47624898f5d08561b78a9b59a176ac7b1ec50d942c3144665d18f928e895bb07c65dbcd4c452c04cc33c3401

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
efd1b6e086d7fd7a4c169ca2b91a2f8c

SHA1
628a5ba82b317c9d8ba5fd36fb15c258985d0960

SHA256
d2e2f29b42aecd8749939650ec208c6e7196e3282557f28dcaa337e6e3a8be59

SHA512
c90730e09f0d37308c05435e2611cbd973245820c15fc979c164056953b68bd93ebab9d91386650a0076187c1e6de1400a8cfb6eea7dd5916d539a8fc1c1899d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
afe3df9ce6315479ac25aee867032223

SHA1
f521e973f90194ef3e98b9b02dbdd6cb3e2b472c

SHA256
2692a99fd0ef76b9a1d54a44c45fc6c06f2b8c840e43672d286ad636ec983f41

SHA512
21766af7f18693f6dd2b1486c2df82a96542bbc73015272a17c72a0783596ed31a73a4591f2ba53d5795d68b2191a842e53bd923efa16075cf047bc42ec36db8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4397fe6110d8b5bb8e724f87721b0348

SHA1
83fba20fe60950676961cb7d5361d71838c96909

SHA256
ea717c16083ffd38555146d25f9cd0c397d865c2055dadd8e1af78789f634804

SHA512
0ef3d94f5342ba92e5e68824c3d4242a0abfb1955fdff2d65410381a8e0df41ee7e71ef98b828a1cdd43fce6ae3ed1e84e66a345566f83abd8131ff9d049498a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
265e6a79b630ded5ddca930efbca77db

SHA1
3f04aab349655f14aa1a9ef3609bfaf94d4ad87b

SHA256
b3b8a1cee8d627900cd16f1ca80cda0a8de32e40b60668aaf7a1d188903372ea

SHA512
a1044bf05dbf6d2bb7d183e26302b0a8b96b8b4cd6b299c676ca9eb75e8b367f94ab306939971a8e642017b1b27185bcfc4a3ae099b8ef4293c9445cd1f41bba

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2fc43fc9ece4b0294dde42e2929b90e0

SHA1
e7e6dfad4ed1a91d40f8441e13225ed106bb32e2

SHA256
41a9c5fc259dbdf166aeb6e29d371e2956c19d27afe83e9b0eb3f4e49fb0b6ab

SHA512
ae4a335f243f5e42d48d89b17c2bc2b5f16f05a3c986b47735bc7cd6404bec74e4c082183f4e8de661da879e6756dcf6dacb17c26c2fa4349e4d89eab82f087a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
29ac0b57402a53a7015669e898e7bba6

SHA1
9f167e25f8d3cb12fffe23a5c9225b6a75fdee9e

SHA256
293a25214fe185d5f54f9ffcf8e5b5817abf7f5a9d71ab54b4d9953add429048

SHA512
bf31c06805d0fbe73ddefe077733fae794a3d09b0a5a4f4075d893a62198c1449703c119e30bbfa512a3801f6b6e373c22dc2b18145016d05791a33f467000b3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a075bbeb38fcdf2f1265e5d2fbc9d88a

SHA1
8bd7201c32c68a5408d4a001dd65f5f6bde9ffd9

SHA256
da3e173460153d311af022ed43673d70f20d7b09560e93220fc1bc351f093843

SHA512
65dac6337bb867b731fa83e8b44573545bde7a112cc12b62c827216876ba48a8b3ec0d236c6b1ec8ee004b6d21bec451652da60a5d412a5575e05ccaed5e9169

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
08a13e97a27f77d72124b0b75f011f3b

SHA1
c38acd1994a8eebc98c7055874587a1864b2f764

SHA256
fa9bd2015dc11a0a115a49bfadccbd8b507312832d55c6c873b7937b4e1c91a4

SHA512
3e08e5bd362547fbdc9f51cccbf05d944e5e29babb645e42ed3036434427d3a57c69d506473b02988093be6801395a1e6a61c63008e401dff38b6e314709c7c1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3e46f31afdc930cce060e00f6694262a

SHA1
0cfebd9de554561b7d1e59bd8aa7f10170f11167

SHA256
f5415f19975541908966b97041b6f193785eecc53e36dbdb6ef0fc94ad2c517c

SHA512
339e0de782307877ec0b39e491c81b9107f672f5df300b060dd9bb9a11d5355d041a34db600a95bb6fb9e9169a7fc5b41f2f3db80f67606e6ca42e0ae497410d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab63B.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar6DA.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit