471c3a64ff04b0f52a1bdcc30cc8cf0423bd3fe240d66f955006489bb4e5e621

Analysis

max time kernel
134s
max time network
143s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
22/07/2024, 18:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6445e3b5b9410602c99171828a78d845_JaffaCakes118.html
Size

57KB
MD5

6445e3b5b9410602c99171828a78d845
SHA1

d0368078f035f06a448e29923da2ceca2914c262
SHA256

471c3a64ff04b0f52a1bdcc30cc8cf0423bd3fe240d66f955006489bb4e5e621
SHA512

dbd8ffbe192b6e842edf0fb6c830f0f09be536976518e923700d58e8f1efdce88ad592a00591aa7b302bda58173e472514b614af7cee3ea351792794a83ae254
SSDEEP

1536:gQZBCCOdN0IxCH9inf6fvfqf+f+f6fGfvfrfvfLfcfHfHfxf6fEftfLf0f7fnfCV:gk2H0Ixpi3y2WiO3zHTUvf5Cc1Dcz/aV

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "427834550"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 00c16a8464dcda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e337bacba951544a9a832c52e69bfb000000000002000000000010660000000100002000000062f5fc77aa6dc6e64b837697d9d3fc2a68f9b922ec699ccc51db292947b4a1a2000000000e80000000020000200000005deb7fb0c17061f1a735c6b15d01cfef7434c35edce73bb838c5be514af08d122000000069c33ac0c8a70a668c2a7da149ab0075bf74171a024d5f378a75ec28b168ae684000000026d7ed1250ecffafb42e29db975f56475cb4f2de6772c2944e4b0a0440d33edf8d1921a42ebdc766904b7d21b7a9adf42c578034a2aacf7c131b757c5cceb98d	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{AA00F9C1-4857-11EF-A839-E6BAD4272658} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e337bacba951544a9a832c52e69bfb0000000000020000000000106600000001000020000000b184d7c6613d9bc643d077feda0220da71f626afb92dcde9b5a10d8de3d486fc000000000e8000000002000020000000289c7314d83dae99c00b90d9eaf500e181008837992194892b3d0397bf976a829000000019e06813b879ec14ba659b26dd5adb690cb84e902473184f1966693a952b607d6a2d4e7e80d6fd2f9fc01816bd20367d430a2018c0cb6a0ae15342abcfb60a44f7b20b9f703d4c03a71e206df429f6966f22960991b2cfad01116c058019c45092656d6a21132c359863b8f413560a4b61bdd083f7fed3d6d491bffdfb736cc45ca411c5d0cdf61a1da080c0c6c0c85a4000000080220540671f13abe1dfa6bc84f441571c7c3e9ead52203deacf370a0958b261fcfa93681c7e684a0b1f45f9c9206121be387cf39c9933246fc761ed59739e0d	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2380	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2380	iexplore.exe
2380	iexplore.exe
2084	IEXPLORE.EXE
2084	IEXPLORE.EXE
2084	IEXPLORE.EXE
2084	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2380 wrote to memory of 2084	2380	iexplore.exe	30
PID 2380 wrote to memory of 2084	2380	iexplore.exe	30
PID 2380 wrote to memory of 2084	2380	iexplore.exe	30
PID 2380 wrote to memory of 2084	2380	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\6445e3b5b9410602c99171828a78d845_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2380
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2380 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2084

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5f8ec9a799933492c839ac10fa58a1b3

SHA1
081c2f3a19df1585aa14c21f5d5e991f371bfdad

SHA256
82252d70d2cffbe30c91a70da8dc3594a3cd6899c103921b0f5a539df3d68338

SHA512
2fe169e1ce958264bebe68a83f5197bc8287f6f1573a2ed2a13ceabee2e3831bb6bddc4fdf266d41ba69fb67e1b0b386c9fcb695c257aa82ed54fbdd3099f475

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9e4b9910a5261217b9b76cda4336d919

SHA1
101805d9805eb8031fd815ff8864db9074ea7106

SHA256
d6158c0eb3b857e08fd56b7bdb99d5a2b16f7d831e6cb3f01147690ac6a54160

SHA512
925ce7d187313fb179ad43821bcfb82d70f6e02c591f17dffb786ffd6df8d44b3cf6275d25c7eb3562e2000ee10bb5be7d7803a45aa33f516bf03b19386fe76e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ca6a97c4ac805645528b05e20c241f1c

SHA1
5655fd135fa7ed7eace34d3743bf9f98220eb75a

SHA256
eca21b467cc5fba409700ed749e03e339cfeea7900dbdd76147274d956c127dd

SHA512
09d98f32008aca5a9efeae777b9e1ca3f13698da5b2f663650474edd6ae80d4f01870493a540fe9fb6d034a014f05222214e2c93b943e6844b40a95c4d4f5960

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
eee79e22c82e10d1740d20c839643646

SHA1
d6a5e5900060ce84345ba077d37f728cd4f7ba97

SHA256
e93cb2ced2bd072f421aa26e966fca222077c2867dd7fe5b63d5c8ee6115c581

SHA512
1043d8e141f1e74c80a477c3cb6ab6176fb7df3e5cc1d4f8a7a392156b03505f15606f8c54a4e5f7a332c3999fb88b03f741f641d15688d5c98de54092cdac7e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f98dcc8dbf09dc217341e737f2463a6b

SHA1
928ed56b485996acb1e2000cc5a745c5cf4bbff4

SHA256
efe15ae024b185b8e44237090b3e7b5a19c41ccdfd124f5d7ea1a6ea482113de

SHA512
5dd0a21b813ca8ab885cf963eaf6eef7fa6978e3c65770d0d391d143d0a55ab47952d4b11d12e8f11e9fff24cd99c0964b8332fc459ec50e36d5389652d28013

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
bede0c1dd638fc8e776f46bdc77486e4

SHA1
c80d4be51d43c6eb26a43eb05ae5f7d9adbbe7a6

SHA256
d78ff8df94c2bb0e8a701e9a46f84495752730edb8d39eb374055900c3c7aabe

SHA512
6be553d0bafe95bdb2ea820349c5e0aa666ab88a75b7048e27502c6373f32c26d4766880633a93dc48c2622835db8dacd1c0fc12de014001ef79d008a675eee1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
15e62d6fc68ca2748c61f3a5a155b792

SHA1
2b687097fd2c469e0c36f9e385f2b92c9cbdc9da

SHA256
d3113cb0183f3e90912237c3026bd1c6ff8a56de8fa3d0e6a17e3b11c8cbcbfc

SHA512
741094c05d34dd3153e8192090662b95ad64c27c151e3fb4bb712d129e2689653627f41dab1576acb37ccb716d88e3aa9b4910cb31e2634f2fcdf680fc5123ad

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f2eedb38c3a383428940a146cf865bcc

SHA1
33c03a7a8e35cbf7d0acd6ba679bd63854f5c09b

SHA256
10bbba8cb2ce5236aba2909184e76d6e2b0694f6769aca4fe9e14d0e24bcee54

SHA512
7ede09447fd70e9d3c1542764ca9a9634b3b6034d5f01002cfa6770b487bff6f92f0a30bdd0d1a5a022166838dbf08c25a416869b9ac92336187c2d1b43bd236

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0882158bb0d2206e0f5b41a9fc93f38a

SHA1
5ceae0792a07b15b094783089dcf5a76b7b54dca

SHA256
034fbe3a6077945b0c4c865e55b79e02b61b8f3a5b93da23d1cbdf99e43b0502

SHA512
3f88aabd6e1e775b30da7191c325607600dfc9de9b7c9f22ded0576901714337e54e8ef57f63c55b6fab6b54c0586835cdfbb2ead47fb69432b72e55134a08d5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f33fd482890285aa2d5d7fcab1879d64

SHA1
b1bb0c9a9d8087726ff5693c4d2cbadc0a976c02

SHA256
505035a3c349d93fda58ed3956c5ce669b781f57e49cff0a39974bb4c82c70dd

SHA512
bb36ab6139460a7e8c5a394bff0b3f7bd7bc409b8e4d3b2c84bb66c9b2d41e0e58a52fb4eb0c949b1e7ee14cad1466207892b93de4e055766f240e672856c793

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
69ab7c28476bc4758dad4dcb3153028c

SHA1
5dc8ed67b13cc14f6b2eac93485bacbc01ef9358

SHA256
75000f3bf9655aee6fcf3f3ee343566379baf26a9fd0b4ebbcb58f6bf57a5584

SHA512
80c25001f4d0dfdf676428a0691ac9c04437fbc23cb07013e62724aca6a361f507ab5e2dc5aa6c7bc3e863c876d89ed8ca6da3f315bd3991840bdbc107301a2c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9293f6c10dea9a6f9ca423d6e654b73f

SHA1
79ff55018de031109da1386c26cb140046254875

SHA256
a6388ed62a3c9e0ff23eff655d1614d26c64a8c6eb5c61b2ecdc563a1a4ff41a

SHA512
69768f1132c1e80df6cbb540685b8eae299279407775a14d6c8ab60aa34254909544441a656d5e895e33cdc0ceb4e72556237333330737e41360ea00929c8e78

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
77ae54a221e27f0e915bd52616215f2d

SHA1
1db21f0748d1e4bad629453a8086c419105fa81f

SHA256
873b3646e802c5500922b5370d9274d111bc2fa920f570862cfc1707f3245ed9

SHA512
c5b7bcb0507c7d01c215eee2ccac4b7388638fda0917dbb65901d9566b29c22aa86a0ea233888e4770cde4ad18b180a4e2fef2fcc71f7892ce96a47a90cdb0a8

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabE4E4.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarE6DA.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit