4828dcce6be31c5de762b51a84b20ada71f87c8797dbac8b28d62741d6cb7e29

Analysis

max time kernel
150s
max time network
153s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
23-07-2024 06:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6682ebb7d72944fbcac6e2b202fefb7a_JaffaCakes118.html
Size

372KB
MD5

6682ebb7d72944fbcac6e2b202fefb7a
SHA1

c7fbf1b3a3ab51cf7ac40c12689c41586ba38719
SHA256

4828dcce6be31c5de762b51a84b20ada71f87c8797dbac8b28d62741d6cb7e29
SHA512

3135a4d7ddfc7a67fbf1af4710dbaa3fec96c3e0236417049e2aaf62c041a40eb286969af4d9f7ff3c308413053f34dd0333151c9d360d44e9cf9252380600d8
SSDEEP

6144:idprA/9/JtgHtlc4ISOy5nDF2T/r0/3Nka4tq3m+Tea/LaJuZtz6:gprA/9/JtgHtXIZy5nDF2T/r0/3Nka4r

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 20d6c634d2dcda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "427881665"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bb7c5835718279428690b074aa627b7000000000020000000000106600000001000020000000b088abada3a2691f02620ce813a4d2800951fac8d379b17d92f9f902c7563731000000000e80000000020000200000000af54c3318eae5f3b3c42b41c295ac9895cd329650109e49e23bb55ef938a1b82000000063a43fe5bbeaae57ff8d8f9deebd2f2531abed721d5f19467ac928fdbb0579a24000000006c7c5afe71de2a21ebe33634270f59346b11637e4bd51ca5ddcdd9672fa3596feeb66239fbda224b669377d9a1d265da8ba4dec70e2b73477a6e0e0b372af3a	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{5D875C61-48C5-11EF-9629-7667FF076EE4} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bb7c5835718279428690b074aa627b700000000002000000000010660000000100002000000049a5e44b4d0d84ff51c3d8ecee3ef4c49a707a48cff6a3688b7bcd32c6386970000000000e800000000200002000000084ee75993187c3822a9d52b7e585a20d843ea9c9cb4b81b1eb1c7aa2d5e28bee90000000a952050efcb2a5c2312059c2101d1dd9119da97f853718a1ec59a218acb83f6176ab547873aa48ae40de955cba8063f9cc3fc6db77ed8df40834166506d71ffbd44421bbbd4b443b4bc69d2d8f7be9fd7361fa709c11ffab2509d6798c2ba541573795fe05c5e729563728fb01cf7967d226efd7ebbb989c8c2a93e2ed7161a21e7be83083cd5d5ebb9102d2282c9c69400000005bee972abad5b783067081259ada736020d4081395a216c8866b5e038349705f97406fb06199f09ebdb3c6edab6ec298f3ab7d1bc248ff134f038ed6013069bf	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2356	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2356	iexplore.exe
2356	iexplore.exe
3024	IEXPLORE.EXE
3024	IEXPLORE.EXE
3024	IEXPLORE.EXE
3024	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2356 wrote to memory of 3024	2356	iexplore.exe	30
PID 2356 wrote to memory of 3024	2356	iexplore.exe	30
PID 2356 wrote to memory of 3024	2356	iexplore.exe	30
PID 2356 wrote to memory of 3024	2356	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\6682ebb7d72944fbcac6e2b202fefb7a_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2356
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2356 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:3024

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\05DDC6AA91765AACACDB0A5F96DF8199

Filesize
854B

MD5
8d1040b12a663ca4ec7277cfc1ce44f0

SHA1
b27fd6bbde79ebdaee158211a71493e21838756b

SHA256
3086094d4198a5bbd12938b0d2d5f696c4dfc77e1eae820added346a59aa8727

SHA512
610c72970856ef7a316152253f7025ac11635078f1aea7b84641715813792374d2447b1002f1967d62b24073ee291b3e4f3da777b71216a30488a5d7b6103ac1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

Filesize
1KB

MD5
115208e3bd15fbdc73879a61d51834dc

SHA1
af3f8daf151a5bc0f1c426a4705b2e8a1bf436ad

SHA256
58be2bf289ef4807a631add565915d53a328d359af26fc74dccf719d39ccaae9

SHA512
d2e0afa831a6c152d0935373b805daca51fa5de869bdaa1ae05b3875c842af49bffd35f7cc3785c589ec3494bc1a570fe844e52ab3810aa6fb25d41d10e15257

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\6DA548C7E5915679F87E910D6581DEF1_4ED7285A0D9F2F14F63E84BD08C45F97

Filesize
472B

MD5
07082e14186550816fb817c5da49d1a7

SHA1
e7ff97152a5c78d31f9aa936c81e75047d1918c7

SHA256
d67a4c647d9014b5aa65006e7380aff55e9cf64ee10c13ab309a7dbc3fbf9b61

SHA512
c22c3ca42328b7123d637903d63e285676232cb3353414869331fa9a5ff9402d42cf421fb8f2b52c3721d8cd5e04ec8655eb39aa8f6c697c39bec8f782b09bb9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\05DDC6AA91765AACACDB0A5F96DF8199

Filesize
170B

MD5
265dd624af3b5eabbaf416766d8c1a74

SHA1
4c9b79c1b7dd7772909f137324ecaf43e2490dde

SHA256
e40a3da146f7f960f14ca559565ae9571d3da879358f35bbbc7f0b81c010d0e4

SHA512
5f1ecd61da50da764d16243c2f74047154275da273e22ea59af3d39c6f262c9e3d16aa839b898ec6a07d3179efb6980eddb6be94866767d9a0877684fdf17b99

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\05DDC6AA91765AACACDB0A5F96DF8199

Filesize
170B

MD5
aadc865293f7edd901f737522dbe81e6

SHA1
b51bbaf5db627bafa9281afb7a8ab919eb387d25

SHA256
aaeef952e9be623099e493dc0a502ff8bd45c16758bfc9670b5703b7f1eb04a8

SHA512
79b9e5193918a3ae646a5a102a1d14843ca4dcfaae48955f7db776a9686aafdd4215cfcf422964027aa6cc99417f66db4e420a412de67a2f7f0e8c0aade9ed97

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

Filesize
410B

MD5
0f5be71712b6c240ba3296a7e070ffbd

SHA1
2e7e60bc2cbf9108aad0a88bd9572751aaf65387

SHA256
af915756a6a09fab0c6380bbc137bd62e9c99f7b1a7dcef8d43ffdb8be483184

SHA512
65c349cef4c1fbb723c478fa7ff41960db73d6d1138e2b860277201593dc8fc90f3680940e8836eee0023204ce2228f75b6462e8bd3b10c0b6a046060fd86537

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

Filesize
410B

MD5
ccf3bbfa1b630d9907ff82ea64a266a4

SHA1
88e825c0f8dadf32b233817e24bac61911a8736b

SHA256
394799e4c71e513d225ff92dfe1dce7582eb8c9c9d4721b880a3b1b4a0f356ac

SHA512
e6eba21e5a6cca70802b123f18a9d42bf079ad1bf7398b93b38311df7e6ac501e56b5df4c6c8b3f17aaaee80d788738c66cbd2d936c474c9e958b8f0a02ae7f1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\6DA548C7E5915679F87E910D6581DEF1_4ED7285A0D9F2F14F63E84BD08C45F97

Filesize
402B

MD5
9b818eb107d0c58df2f25e7fdd8be25a

SHA1
43727d28295c84f4c74a149d74e6e236966c0be9

SHA256
4c58bbeb930d368c329b9557693a2d9e650805795dbc30f8a95d6914e053abe5

SHA512
a4c79cfa2a5bea77020c09f44814c8eb867e28450963e1335d4fcbba8cd184aaf3ec448b669f578d47ff3096eabccce42204c3aa50612942bf83306eb0d2f92d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b8b919474141ff5f1f81d24f2561b9a9

SHA1
acb661b0adbdc48da908aff16d118c6d35d7da01

SHA256
80537b42aea6ac367899ce45335d447fffab8af78bc5d917ece0b553983f7ac9

SHA512
055c0346ab400e6785f64e5fbd405b9b5bace4dd50c94b793df35ae854778851f812652cb35123ba9041c9520c9b1f55e1e694c524108e82b2d912b5e1dfd605

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\NFAY0EOS\4CBC8409.js

Filesize
157B

MD5
67e216a27dda24bdcb086c2385b0cb99

SHA1
17141c80f5d32bec3691c5ab24741d8b7dd5f0c6

SHA256
9dc433b2142d3ba0803fcffa53f19d34da26996d20c829df6d694bc887325dd7

SHA512
802319543dc64cb011bc2684004e878a842b73aa55e4da1141ccb8650cbf42fabbf2b46c730760bbfcc7a140e11700244b9f5da78bafe9fca7ec7825c12b4255

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\VOGNAB2O\cb=gapi[1].js

Filesize
135KB

MD5
cb98a2420cd89f7b7b25807f75543061

SHA1
b9bc2a7430debbe52bce03aa3c7916bedfd12e44

SHA256
bea369fc5bdd5b9b473441583c46b9939232bf1f98c1cedf6bc2241c4f5068d4

SHA512
49ccede4596d1e5640a9c8e8be333f9c18812d58f02b2b15adb54172df1387439e9dc5afc4ccd9d8f0f75f092318bed68d3cd577338e88ef4f9373de8a07c44e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\XWMUP5AI\platform_gapi.iframes.style.common[1].js

Filesize
55KB

MD5
881eb3704191d887333d08190e37b9c3

SHA1
fb5f7a2259c6e2d0a986f1df7da0017f6f4bc198

SHA256
03759f99c9adbff1efc85f512a97546207efcf91894a08b131bf59c2e2b95206

SHA512
860ce2d7e2ee0a1eea2701af9d0e01659508e26bcbd2b4456bc926fbada737a067fb5281085c00d136f6294964cc2a6764ce2c12cf3fd32a0f130c117a6e3191

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab2C6D.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar2CA2.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit