51edf4e7ad4a6c1f65a4189331209dc5c126ebadd6f5056a8fc25becec2a0bae

Analysis

max time kernel
134s
max time network
148s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
23/07/2024, 07:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6697b476e4a46b09cdc7d6386fb13dd7_JaffaCakes118.html
Size

11KB
MD5

6697b476e4a46b09cdc7d6386fb13dd7
SHA1

75b18254f03d89b22583420d528aa8a361741c20
SHA256

51edf4e7ad4a6c1f65a4189331209dc5c126ebadd6f5056a8fc25becec2a0bae
SHA512

1400417887560a38fa8b8413cf6486dc9993d5cc81fb0567138841ff2e719b703dbc6ea97c07df96f123b9e9191e11f86342db7dbaeb76b1b6c373ae066d79f2
SSDEEP

192:LYakbr5ADgUN7IEVf0FbV6g4I83g0eqClOaqsbE9pCGzqFEz8O9L9z9s9Iv2CL:LGbrOcQxJS0eVjtbE9pCGzqq8ix5Qc

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{DE5D4401-48C8-11EF-9EB8-6A2ECC9B5790} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "427883171"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000003e1c4d4a7885794291b78de8e6dfadfd00000000020000000000106600000001000020000000071518e8dd165fc39771aca285f0025c816f6521fd04e786eba292b38d957262000000000e8000000002000020000000db9079c9f5fd60c4ddfc27c4dc24d7a34aacdb92437b6b8c2e4e8623075ac0459000000047dc8c375e00fcefc8181deb3450d4e8b7152f4f04b2faafc6715bd8962601be21cfaa4c753afe8647beac2d2775374c63523ee594a88469663eb2d5a3549e42b07307799837c9b95173d4a6db1dc38a7b2d75b817c5bfdb9a0510b4d5aa8019764cae202d1058618f5b433ae850455346782d65a61c9fd87fd768566e935c38f15f08042c386dba89ca240f7f65f1114000000033c9d15b21021b30e442809f6dfe9dd0727eb4fa3427f9dca9f9f911045205abe495afcd7222d52afde277a6a12e0cbfa4e86c8f6774e0234879cc5438266991	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = b0b1cab7d5dcda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000003e1c4d4a7885794291b78de8e6dfadfd00000000020000000000106600000001000020000000b755ceab0c7b453e3d07d91ebec3e8a017aaed5cd831933bcfad7f5d5fb612a2000000000e8000000002000020000000216414955a1bb9e888a386cfac10106c711bd7ffb4997952075d52de622cc03f2000000082acd4eab078b42ecddc769051b2764fe29a20289f48dbeccb655931516d2f5c400000007684fa5bad7e23b50c5af88edaf0ea806ab163753cce96f0337e24267a64065e8fb43dcf77d0be8ae726e04601fe0b65f601616667914af00fb78f0cabe46578	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2648	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2648	iexplore.exe
2648	iexplore.exe
2804	IEXPLORE.EXE
2804	IEXPLORE.EXE
2804	IEXPLORE.EXE
2804	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2648 wrote to memory of 2804	2648	iexplore.exe	30
PID 2648 wrote to memory of 2804	2648	iexplore.exe	30
PID 2648 wrote to memory of 2804	2648	iexplore.exe	30
PID 2648 wrote to memory of 2804	2648	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\6697b476e4a46b09cdc7d6386fb13dd7_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2648
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2648 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2804

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1a50442a17293850d846ebbc5c8f8796

SHA1
a20471cdea7c74d6511e3f9f6fb25b08bc688101

SHA256
2afd5391586f79d26e3d15351ecc20eb95366c5e6f86abde703cd28ac9c7cbb8

SHA512
fc54bddd5977e385327e22af16d5302b1fe8a0733856c81d25efb70c96cea9ff43df6f86c1e76e490547867acb7c580d904e5f5b9c5173236b93f9708065eb2c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a572ab849a11798321e4cbccbcca5136

SHA1
52138cec35f3f5767d39d4f40b24245b94465b29

SHA256
cf43de0ec08726d1f45ad3d32a297d84e8fba765fe7d98256d1ae721bbbbfaf0

SHA512
901897445276dfa52356b6e2f2f18a3320cb3236f0d6081388a373374457af897b22baa9275b3e053bc57c23a49e35cba7cb5c215010c51e0538d41d8d30cd85

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d879d7c8f51f84e1dd3a051d8bf40f88

SHA1
86414ddf8528555381757a2eb309f5b4660097ee

SHA256
743f3cec66e47f8fb009fc2e6db9adb48c8dc685c4c55cbdb43d11f9188dcb35

SHA512
ebb07e85c9bfe856c86d8a8b369bc6a8fb3c945d057b182c1e019acf3d0a2b7e99aa6ef165de55e7e8b4c2b9082482a58c002e9a3518771a7bc08a573648dfdb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0ed694ccc9a538e41eab3566e429bb4b

SHA1
c6817500e14f532eb8049a2a92d19b928d1e82ca

SHA256
9beaefaf13bcd0733d1b98a4f2585382efa692a2cbae56064acabc7a0f0ee668

SHA512
15d37aef3c006691678c5587f9e2e46c00faef6e68e383befd833cfe67a1b2423eb841ff4ce3c6dffb3e98336e67f5ae00724f98e8ae4563f64dd32e92b276eb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
66d7d4460d216fd70811b5fd2e54bca3

SHA1
1ef77df9b8614fa2ce48fe2972d3aa6f864f46da

SHA256
5ee124c0d6e1752e8cac3fdcfb6fa511107f7c14837635f851c5b1d20655958f

SHA512
beb961849200d07df8c4a4371d203da2e5c6cbdd7e5281d200eaa041190d11e9ace7fcf9931147632c4ca523a4224ccbc23a37e2abfb121e0a63595b9c262224

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
bb4d0a59190c5995f9f2d79084bf479b

SHA1
bb4becc8eb28e86f28a35787ddf4baa3e8177ffd

SHA256
1717dfa97333df9dc2f0a6c9a28e9ed017cfed30fab1881e1a7d07da47b6002f

SHA512
8889ca0f534c251ad7350a06832860f3807a1b50f8c9c7166d3fb3dd01af3475482e979cb5782d9f3598c485a6042cda4b1ea2ded8878312d4af1aa011b28705

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6794054bb435061e80b7c627d03b99fa

SHA1
67d41229c7b5aa663a57340fcbe7ec549204c32a

SHA256
8d96641a6de9f97696cc3f4973c95c010b847f70d9221573b72fb78f0b882a23

SHA512
1c349607669fd0f8ed64680442bef6e3794cd1a1111f391a2d5d5ce96323708617007c912ad4f5f519094ed85290b81cd84a3efc2cb6aa0df8d5fe62ed293535

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
74a73bfcd24bf4d908426cebd3e0b4e7

SHA1
f410455e0327c00a1c3d826d6e090919356b646c

SHA256
59c7aefd642c11fedef8b7963fc4b796baeaec70b129e2da47d2d5cdee02ebc8

SHA512
efe36fcb4fb89d1f970b5cf3f0625ae1b8703d7ed61b6b084da3455f4085b5b2ac6c3605c5fc167d0433ec53fcb47ec60b4cb898ebbeb047c9ac9d1bd58f8bc4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1ceeeb7015277df9b55ddff7c1919a93

SHA1
d65a26ee166109b25bf1a27597457f1c025ad11d

SHA256
59668d0953ffd49facccfcc04e95c9c8fe8b92817643515d5af6581a1ddd77d5

SHA512
ae0415bb6fc56d3c03a1bae01a13dab97dd7541d5c8f0102d7448a5520457dd401186ab4dd6f81a8c4605935bdd15a88e1da62bb17dd7a0c2c5f7092ac59c4df

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2a244fce2ab2de8efe7334af56de331b

SHA1
df3da6e1181a733f8519849f69af086b39828ea7

SHA256
5730bb67eb1d004bc053a0855bd812cfba7eadabe31470e0e3b61cfb97c46b0f

SHA512
b211ff4150cecd50640c3e1bc6d25547797ddfa8907ebfd64e4e18dfb95fa35535475deb6facff93e4b20abd9ca2a1288b824d444854a6f2aea0b9755af9cf36

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3bb0149f74185b028a95579f2ce7d1ce

SHA1
7f9ce0436e39763cea890e7169779a8385eb9226

SHA256
6f21a45bf3fad8d4eb83088a29904edc947d73ae9b9ed562126e2efab1439fc8

SHA512
3c40c92b5610ecf49f2d4d6b817b89472b713fa4d48b68e84c75587fbd7b1c8ae534bbd4e9950fb18f804085a5ff449bb0cdd9d5a8d7ab1bda2f5553df3def9d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
06a2d931deed825c274e5e808966f897

SHA1
b87886623020ec87cc05e56e02211bfe29df1609

SHA256
83c9cccd7204390165c209a34c5e0750075cd8b613ea86f336cd9cb6f514ddf1

SHA512
efc74307d8ee630c2ba1edc846205102e61795d816d1c28c8d7fd80f2d242691bc298471db42c211bd5aea53f9c53a1eb2edb4ac13ab2b9849cc48421b9d0e79

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a3344402319ac615b65ffced27c2ae5b

SHA1
9fc8c2ddd99fedbcd3db60d48f718390ceb0c5be

SHA256
c7119187b19aa12ced2a6d19634c85641e91f45a9d3aca3fbfa576d93a0a5996

SHA512
1965f200128dafa5c7ce9f35d87440f930e963e21d472ebbe049aba4e8d0abd7552d3504ba0368bb43c382e297c8b5eeb92dcf20b4ef7dfc508b9a30b358e6b2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
85393b87267cc6d347d416bc49829d1c

SHA1
d62bd86e299d7c0554c8fdbeab1df3197220578b

SHA256
3c124de1da575808a40f4c0722f19d5d7a04e2947302bfab345c978e6a665fb0

SHA512
9e4922e622ac0facae8a358a9d1c07cb4be28afeeabc998b7142f878c7e17d3c56dfa16193759afbcc0a0106401e316c50552cf0aa6b6c03e5b324705c679202

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabA30.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarA43.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit