c0ae8d049dda154f3639d18646bb8203e182e46deaa935be2fcf76c36b12c3d0

Analysis

max time kernel
119s
max time network
134s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
22/07/2024, 15:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

63c13a177a654e2d9f23518cd85a2994_JaffaCakes118.html
Size

90KB
MD5

63c13a177a654e2d9f23518cd85a2994
SHA1

e6bfba3bf041c8d1f32538956f6e71b216e79907
SHA256

c0ae8d049dda154f3639d18646bb8203e182e46deaa935be2fcf76c36b12c3d0
SHA512

845c11db0fe6cbca99c76dda3bd7fd0113a3dec8846c8144acc59d165f249afdc2bb2c353d2caf63c96c213ad33e6576702097efaecc3088bc7789eafc7f8f67
SSDEEP

1536:1vY11rJZDChjzWeU7wgrWKvvOOOZVp5BPR4:1vYjaPvN5xR4

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "427824993"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 50f9f33d4edcda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bb7c5835718279428690b074aa627b7000000000020000000000106600000001000020000000fd7855623d9d57d99c6ffb91b418cda2cbe3de663906920c66550e5c9b2a72e7000000000e800000000200002000000047971803e1587c7ac8367b295408dfc107e6495a71af6395392a5b7ca7aa5148200000005b651c97f8c0d7f52f47711c03dd3d3331dead52ccf14acf30fdf6da7b65fd2340000000631dd02f7f0e9502d0e90fe66e75ab00fd8e40218962d45f9961b8ad452c5e04fafa3973eeab47dd3218fd6e1fdc84663588cb94c1aef48dd03224a86b4520d6	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bb7c5835718279428690b074aa627b7000000000020000000000106600000001000020000000de086f0bb9b8ffc7e26186d64ec67187b49945cf434c9426f39a34c328d65067000000000e80000000020000200000008e20ce306dab86a23277c85e6c0a20aef51ff654c53d0ad9aea6ad4f90a90b2d90000000265999089c2b9164c357d819639bc20fa10ef4e25026920bc642e9f84aa5319140bcba705a29b729da88b6abd728a031773be53a16e15bbbf59b371f99ac3ee1db34475c46072ac5a61b818cbb3debaef45217b8b9487d9cf4625841ee31de342866038c0e0940ba9557626170a47b233dc99a5518f0f5124766c53eb16ef446c8bdefba0d1a80a1d1b5b739b1147f9240000000662fea23fa95f9fd693afaed8858dbf03016d814c6077e00300656ddc30c3426b7695062a19f710bf9074a85e5cab8567682be80214d348f6b00f5efc3ddfb30	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{68F82E01-4841-11EF-BA91-7AF2B84EB3D8} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2192	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2192	iexplore.exe
2192	iexplore.exe
2584	IEXPLORE.EXE
2584	IEXPLORE.EXE
2584	IEXPLORE.EXE
2584	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2192 wrote to memory of 2584	2192	iexplore.exe	30
PID 2192 wrote to memory of 2584	2192	iexplore.exe	30
PID 2192 wrote to memory of 2584	2192	iexplore.exe	30
PID 2192 wrote to memory of 2584	2192	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\63c13a177a654e2d9f23518cd85a2994_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2192
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2192 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2584

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4fd64e7cb35ff8f4b7b1d3b0dd3f60cc

SHA1
4287f54644c1a1a5cff0a654c31cf823dbfcc900

SHA256
010ee4fe0f35da953f18eaa182b0052690968670aaeb8f9b5637e1c7912f756d

SHA512
3b320239df9749860839e47f086d582e02e1110a5cb57a8c44cab987aad58416d23d2c41ec15f91cc536908c8157e70273fbe833cc7014472e8f66dcb4bf2ec3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8d5447d53f39900f68c203fc4d9c3ad2

SHA1
12a4ce8c32cc840ddc9858d9d1e1c13b6cd7abd4

SHA256
3109274a3b891fd631cf949ecac4a550b2e8ab885cd4b8d922cb9451626284ca

SHA512
89b7b52b821b323af2fd0232f71d9d91f7ef44b689243a67a05a1d519dcbed45b93f4d51333e3a18cd3f25bf12c4f20361aff16693116836b7d252465807b7b7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0db67afc794bf5a66cae0beca65551ff

SHA1
36a09569e79cd67f08df184180743926f22ba019

SHA256
baab480521bb5830af8792cd93753c710b3e9c5ceb5d9d47f678653a33ccbfa2

SHA512
ef915bc377ef4e3fac1bd267e99b36dc0a61fd168333e0ddebf5d4a6f563f65469afeaa608322f08c80e3b0f65431dbcaa3e6bcc970f6c37b7bc1a1cff75f66e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9727992ab590a44dbc3eca2a081b85b3

SHA1
ea0378dec0f6580de87c6872b7c87bca013a42e1

SHA256
7b9aa618a89f39cb9de906021aa3a9b84635708d1afbcf26a0ec336f0901a705

SHA512
d7237641424ec62ae6e80424a21020ce22211f0c9b59a382018d0711dedab73673bb9cc7c27a20b0db6fd6f582346fe1b72a31abc2ce705baa98c5b0725216d4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
392a5dbadc9353e26d887d94a26180a8

SHA1
a3ecf08532cc25dfcadab90c1f1ec10528dbec6a

SHA256
e1cb91185f24a413f553349a7a1529708b945662e15c9e54cc02409af208f1fb

SHA512
831fff0bbe5d2ed2e68c146292c5f73976443ee1809c453c6c206094497d348f01047b03f8d8a62d711073d21ef9ece37f570303900559a7eb947d67de0ab75c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
880bd5fe3ffee6aed508aa8b60df46a8

SHA1
553f0b4869f9e9ebf16248aa6b6d2476c9bae41f

SHA256
71b8fd6abacaee6de531e7ceabc6f95f6e05bd1f47f2f63b62f7a4b6acedf414

SHA512
c911ebd0809cdc8005cd3a93d1844d3c70cc7fcf5f6f8f7c075bd990a602bfa7a06a3ee981b1e030e617ca9e350ed98f777da314f0c6309db50241b87c8fb545

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
fd708ed0ee283fdfc4c35149124d8372

SHA1
0230e60d24be89e38d1dc087ee64d8794196fbeb

SHA256
2b476b36d87e2f3ad953bcafef414cb960b24bdfc641689ce4b395037b14e39c

SHA512
bd228338cb4427e49a85049a5e04f0d81fe419feae379b84cb3e59d43912aaffcfcc6206345423075b43f18129d7586178d2da48e1ae951c3db437dcce91294b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
064b064930d882f769a30c79d58db236

SHA1
efcaa2899ea4c796100c4a79000fe0641beaf0cf

SHA256
0fc09b3a4ad6f87e4942c0a91870f8abf149ddc2be2bb26e62a34d6b711734d5

SHA512
2cd18e7c068aec0f20b37f346479cf5dd2594be748f1b9ab12e531659d65d8d2dc7801ec4b4fb349e0049e5f9d62493088ca95fd3397a5032085114fe0a27816

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ad3d05ec2140d86f6af7c5830954f386

SHA1
2fa6293421ae1f31e5d988e8f438c75cd5b5639f

SHA256
cfa3c98189a3c31258c128119c8d1c9dddbeefdba501b7b27986c36013244a14

SHA512
c19a9315470ee0d7ff6fb06ed121317d9dc4e982e02aa0504a91c8f1ac8f2b7660f25e099b67162f7ff3e8d75abcde69b025cb996631c1cee182bb7ca3d89d0b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ab618405ec0b0a4f105d6dfec3680370

SHA1
bedafa695b5762238b7042edc9143ec8f7cfa836

SHA256
a014f9bd07db3f423f91e7d4c45802dae7e5d94513893fafdb034f0dd07592e3

SHA512
c14231076ff3ce5c66a05e38422f30d3d15565310cff56a1d1eb922dad5d8b2db2c5dcbcaa4dcc4253ac47824e444d265531732515f7d5494ff015c188a1bd75

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
10073a7ed96c378b4768a8559ac981f1

SHA1
3aaa050fec57fb4a4533fa979ddc8ac179180c63

SHA256
34fe7f41d2c00edc9535e9e2c9833c526eb9be59dee701e7e00c875878303e75

SHA512
574a283b45b4a7d8091b3d62708ae0c3c0d24012710aaca7206151b177a5c6129a1cccfcb0b413a58a4086eb4a4bf401d94ad243007abad3195e4a211253ff95

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab3E1C.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar3F09.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit