ca4aaca3f28a03817cace68855392fcc3a5d369519229efb2022e29eb66f2d7e

Analysis

max time kernel
141s
max time network
148s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
22-07-2024 15:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

63b77f2aca2df8b64e6128875a0d127b_JaffaCakes118.html
Size

77KB
MD5

63b77f2aca2df8b64e6128875a0d127b
SHA1

022255a15434240e1b193eb6f97911970a68eb3b
SHA256

ca4aaca3f28a03817cace68855392fcc3a5d369519229efb2022e29eb66f2d7e
SHA512

48d6a6a552dcbd2d1f1681343993439fed1714f2c92bd424871680f72a9bac23006905d3d7c569f646cf66c16711a81b4c668bbc7959df903997f887bb2f669c
SSDEEP

768:Zcd9QZBC7mOdMAPpC5I9nC4CO7BScegFPd:gQZBCCOdf0IxC2ygFPd

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{89234401-483F-11EF-9FC9-7AEB201C29E3} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000082ebb0b9d6f3f0458e93e15bd38f268f00000000020000000000106600000001000020000000f8012cd61289add51576d0dc2f81bcff0ad390c8a943d535c1cfeb57b984dcc2000000000e8000000002000020000000df1c9ec3e39c73c552d98d0e8712204adc3f8c19543ff585d95a7d46278601c390000000489403580f9b86ae7593bdc0e97ac7f25f29fcdb9fa1e8567078e392a85842709bdddf495bc9361eed673ecd767a142588bf40f2bf5a1a40900c6a3e66ce87c584f4275013c8888c5e15ceac1a997d310ad2e30218e90ccaf911ea2e42d61c17dab7ea64fba0811df9d1c043cb82ad156c4d2da052f22c084973f41bf98f79042b89cec49b6b3a3efa99d8f3bb16c4f6400000007f9940506074db5011623297be4d5f97401ede38bc243d70da2ef05ab8e50bd2db02bc495b7e62e75fa64fe23c21b9d2395a8246785f03ca6cdfa8e64042f7d5	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = a02345604cdcda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "427824187"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000082ebb0b9d6f3f0458e93e15bd38f268f000000000200000000001066000000010000200000007ca17e0a491be0343d5686fe81e75a932586ff05694049c54155a4b8beb35ff1000000000e800000000200002000000081e3466916d315dfb1385b6eb8a127e9de472515f5183ea514974a91d63b89512000000007ef01391b602f23d4d42dc5833f5c11fafb46e9daebc7ebf9704e5173c689e840000000a7362bbf3bd75fb95da6cf26b2b1c3db929e5c9c0eb0ecdcf257c5b893492be7bb6d535663bb7a4a59a68204106a9bf06c66f1b190796317cf7f593f600ac07d	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1672	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1672	iexplore.exe
1672	iexplore.exe
1668	IEXPLORE.EXE
1668	IEXPLORE.EXE
1668	IEXPLORE.EXE
1668	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1672 wrote to memory of 1668	1672	iexplore.exe	30
PID 1672 wrote to memory of 1668	1672	iexplore.exe	30
PID 1672 wrote to memory of 1668	1672	iexplore.exe	30
PID 1672 wrote to memory of 1668	1672	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\63b77f2aca2df8b64e6128875a0d127b_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1672
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1672 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1668

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
56d79a93c376b27367a95392177ffa05

SHA1
a6e292bdf49aa9e44603b9edd8593be68093faeb

SHA256
976d5ec26cb96500f2b88c0b17beaa42f6f3f259ded87c679e1a3368f66d6ac2

SHA512
1ceb3fc9312c1d9dd56774d420b6da9aac4c2c63e0dc82a0b6c96b7089308d8bef26c2cfd8f254e1068c396231854bf55f21c5ee7b319a8254b9a998314137e3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
127669f24ceb2fd797b93e067183a7bc

SHA1
c6b21c3d4a93b49238f35785948ae24f07df1bd6

SHA256
c038094cc0760ea801c58953023f7b28a925aad4dca96931bf73a9b878c37913

SHA512
c32634d2c06b7da2c1a2fdb6667211fd79ee9ece8b763309101c5aa555a5e4e92559ae0e90b1033dd62d13d8ecbbd48d4bc3b8f95447ef73c83fc7add022738f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
401543ddc5fdd2643bc963a67e3dde7f

SHA1
2230b6a31007d7bccc2b500847691a1e065dcdba

SHA256
ccd283010f867ca658baaa901d36cc933b6ac9304588117a5a702ce294310d5c

SHA512
7fb518c5e1fc5ad20af6c0a243f4da6d5d83ac44f4324bf579e29455176d492dac414350faa0c7782748f85391f993619944d188793c07c965a80c70fdced7fb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
23adebf2e9d0d408d38869355aa9b678

SHA1
b452acdb87d4079d16423113943c7f7cce3a0fe1

SHA256
b5404db6e1d2c4f153e44f4ec4472e36ccbdcf383074f5626571f896eab7a8d7

SHA512
04bc3c66866f8ad8df5b87b2f6051026c42f4810e6456dd2e9710d0c4405578d2c25e63eec95d8fa5ae81be536bd84ddb649d0b4e93eca0a9bbea136fccc576d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
29dd88ab247ae80a6d4cd3399612dd70

SHA1
8c14ed09c9ed9789849d0e44ab7b05e2d5501436

SHA256
f275b2998877dc1868bdd2234daf3c3fd41cd33cd4695f30b207296fb27ccc3c

SHA512
80dea717171e2cf72ceee14ab555d9cb8cd9337cb6511327e542c2784f496cd167e91ad9951509dd3faed23fa92e185ee94ca846b1db2d0a23d78d23aef9c5ed

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
cea676c16db6aa956f3b14deceb22f84

SHA1
8f849fa0a2da4ca4eaf28d71096c3f13f1a5e84a

SHA256
c62ea971ec5d7082b59e20aa2ed912a4203ff39ea26cfe16f63cdb11066c4b37

SHA512
11980d076dd9c2a1574a994f81747dccf3071cd039991adfd3553a349e78347c980e4dad4b49827857381fd9aa6a0b0b120ab98f30b0f0ffc5a59c79b7ad7c1d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8fdb834d52e5357c6594576b85d4b2b6

SHA1
fec8330cdea72741db90357d0a18660e00daae46

SHA256
ad67fe318e08a5d0a3df27d7fcc13e0460b0b7bd22db9105805d9dc65ed83a3a

SHA512
9597369d3dcad65bee08baca51a7f3c5828d68fb6e6f9bab257cd49937cf8b7c7d81dd7c38d2f35571f2b79ed7d84b8229cb50591c37be40c40f582a096c45f9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
701f34e0f4869d1ed7aa27b83f6741be

SHA1
843d577e7ea8bb5b5da58dedea0f71d5d475dbc1

SHA256
c9cdcae66995993d1a3ce0a3382c349600a69ad493efd53b51ffb02171aa4c2a

SHA512
b676b2925d50292ee41d8b8f9732fb65d39b09a47d7d744135d1de4171cedd8d093412dc8391d1e9d74e6a7f5a23b373167737865a189ee9e49a62b59aab5491

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4c9ac13716909af4f7343e2d21e72e32

SHA1
0c593c3f2cb1c2d4450920e0b4fb214ee106e8d7

SHA256
1a4ff7702c374424d1cad7b15ceb60c282c504e3965e14af9998402bfa2a4d08

SHA512
9b78cdbe78e2e7829fa17bdc5c96c07bc7c09bb384780adda807d636e1bba8095a40a27e8bf95b4ae74d50bf6685b676f7d36526f49b0bfd7265e7bba7d7dfd0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
70992b9179935bb355abb5bc9f81466d

SHA1
a19fd427be012a9b9118094fdc73200eef036ccd

SHA256
a7626d5c5c95273fd21edd6d5fd6c2e2ddca6a87af88080beb2e9f135d7561d5

SHA512
69dc2e490d204c9a41838b2b4ed63251cac9382c9393ea2335ca4d31bbd8dca1d110244da2d9b5ba2fae72c6c6cdc8997c0241a9048c8003a364d30fdc4333e6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b43c9e7af09645a0858464006ff184a5

SHA1
b7f6d87fce514c69f319da5effb7747d8fcd15d7

SHA256
0ae9df80507466a7b805f8301a0174ed11dfa01aae4426364628da6a411ba5c6

SHA512
26b91a81d6612cb9f46bb527c819fa2f3be03ce7f0d64702d6d9a200cb7944be83c51149fb13e5dfaf539528831e8638f5d3dbb8922d3a00e72de63c104df732

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1ceb7e9ffa2af4073b0d8a80d1b1ae16

SHA1
a57532945285bacc5241b754272805f0d3cc93c7

SHA256
05b3defe88a540ddfd9b1766752b03490e4f403ccf9c819798362b0ca6409ab0

SHA512
1089b5c9c44c78e1c685e7c0ca7798e96d147157d86c7777d94238375e76d57ad08096d60ba8bc4f9897a73ea40dbb079625262a7056934c383ba27dc35369b5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
53f313c419960a3dc944dea8590e5697

SHA1
67e98f2585f0e1d672ac58e9ce0f79535dba5a15

SHA256
b2368f38e55c425e2be12c85ade85d1d27c0563cd6e134a40b51597b5fce8fed

SHA512
ce57d276aa2f4e072e39f19dbc8e862a71c7a87d1ae7772fd8a2ec12392641500b5f116d73fbc939963ece5b2cd767b8718e0746db9fa018c2a78b92c1a90646

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a9a4f7b5b1edfeea113e717ccb1d2a08

SHA1
96353a742df3faf1fb0c80418ae2318477507014

SHA256
1a11aebb6cb3cc026959bebf250921d58611e8143b561316d9d4acec398902ee

SHA512
bd8488e46e6d5eaa9126374ccd9f9afbfdc777d342797997e4121607c1bd62623394078a29e4b661c10a01f38cbb59c6f1f273937f84a531a299cd05ec344062

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
42009323b4a50efc879df42c9cd045bc

SHA1
34ef22735ebe984b9c4b62af37a8aca2f89fd048

SHA256
b48e36a730743c6f0806ffaa33b176bb876be865169664225c8f60b06800241b

SHA512
74121fb8f38ddace1ac12350f53be9e1cd65c390dfc6b71b3701af84fcd5213777560545e817491adf428540c166bcf1ec0aa6a0396bb0d419531282b4ab4e12

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabFAB7.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarFB56.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit