f18f8648d6298083c07c02293ba99e8c2c7e9c260e77b2364db9df65f2b0eac9

Analysis

max time kernel
119s
max time network
128s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
23-07-2024 12:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

67a9fd3d41f2ac5cf2704095ea846b59_JaffaCakes118.html
Size

11KB
MD5

67a9fd3d41f2ac5cf2704095ea846b59
SHA1

2effcf088a0dc5858ba908701c2d6c4a471ea470
SHA256

f18f8648d6298083c07c02293ba99e8c2c7e9c260e77b2364db9df65f2b0eac9
SHA512

8fda16cf0f650ed4ba57fe15c2a7fbd3c47249af297790ac44eb1889a1b6e1d0ce31729279a834b4b2e64b967cc58e1ae493bfd001285d1b047da283670d4854
SSDEEP

96:uzVs+ux7yLtLLY1k9o84d12ef7CSTUBGT/k1+pEooYPiTe4nsjuFsrlVHcEZ7rur:csz7yLtAYS/I2nATeau88PHb76f

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{3239EFF1-48F2-11EF-99AF-7ED57E6FAC85} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000082ebb0b9d6f3f0458e93e15bd38f268f00000000020000000000106600000001000020000000a6452a003f352630ff34481597dbd55015ae3425dee3b72afbe5aae0d446786a000000000e800000000200002000000077c0703df8cb07de87ba3b5c78b76bc9ee4cb523196de6d6efdc1525c7c554f69000000056b7d6562a349acfaa6fa82e0e921268362d9d56f7f8a0d581df0de02b55babb50cb53f4b5755836b706eff321b08fc1864f55ce63ea4d8a904e863eee2eb95db7e26e86d93f84ac3852eb0b6c7c103acb4be69a62862ca11a8e037e39d3673e9a45b179e4dd5e8fec8b61d9a030705779b9e6982991d1675b33b6199d8697b8a0b3c8247fcc81b8e482ab1fa5a0ffef400000002842192a31282c3b82ea2f38e56b57501cf9894551bbe36d4c6ad4dd343bf3de6d8e52be2c784b94a3a20e0facbfea7d3e538a86fe9307af2b527cf7aec65f97	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000082ebb0b9d6f3f0458e93e15bd38f268f000000000200000000001066000000010000200000000de62819abab80bf4e27524863a82b3b69de115ce13fa36af5a7a79b04785f14000000000e8000000002000020000000c97ee2834b1a86d042200d175ec5137750b902285cb52b68966ea52b4e223a7520000000534f3404227b001aafc33fa67c460a396b09bfde568c6f94c43d08c5d076ef044000000067b2c2a199975005ef30510d0f411b4557d86842f5d2ae4242691180aa6d78996fba71c681d8055e284322f1edeb2965e75e3369bfaf94d6d872efb7f3233adb	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 70978109ffdcda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "427900921"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2172	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2172	iexplore.exe
2172	iexplore.exe
2208	IEXPLORE.EXE
2208	IEXPLORE.EXE
2208	IEXPLORE.EXE
2208	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2172 wrote to memory of 2208	2172	iexplore.exe	30
PID 2172 wrote to memory of 2208	2172	iexplore.exe	30
PID 2172 wrote to memory of 2208	2172	iexplore.exe	30
PID 2172 wrote to memory of 2208	2172	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\67a9fd3d41f2ac5cf2704095ea846b59_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2172
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2172 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2208

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4b7a2bbfccab2e64f5f7bd5a4661610a

SHA1
2bf5db6fe1e2c652099639bd21f9bec43746b2ec

SHA256
cb59e7cc3507fec3198cbc238661d9db718e71ccf3ed95ea2e113980b34e0f39

SHA512
821406bcdd609eaf551145ffd1c3afbd2f0f5c6444293bccd6183af120c54f8828f2e25e78068021db836e042cdfee98692bb28d85c9f268e32876ac18dd5507

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
712919b7c365cf9d9afe5ea66f31854a

SHA1
5569b85dd2c2a70d234123b6630298d0d602b3ea

SHA256
7b98717e1ebd6d3119cbc65412f5a2cd55a24ce022997357855ad1991e399436

SHA512
8abd282cfb192463cad5d4f5fe3d006bad1cad09ccf2be1c89dac2aa6de7552a1b1e054a14670e3e624c8910807adda1320e809d8225fac87d641b17685a4a10

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a9c6456ba5913410c582ce8686a0bcfc

SHA1
082eaeed25d49866c18e8d304180ad7d43ed142b

SHA256
298fa3fc1fd5983ab31b67262d588b269e447597ff5647fdadd3121001799fca

SHA512
732787c51cbc5a7177002409f357988c2ead4fcfc6561a8c484f5e3fc4c12d5309a231f0ad719dc2cb885ac475486c208fe2575a6e62c612c82ac9eaa5d17011

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
21756d1d3a7acb424742acf9961fe8e8

SHA1
96ab1110f1c652d27b71b58c74a9d47928084ab4

SHA256
90f44e32cef2c7765e3b5f636b78fec484a765d3b034fee21ed2793ea6e7b53c

SHA512
4876c81256ad371fca40c1ed20018f495212c364c25fb34d1738e6a3dc8b5d9beaf42796468e6bacd0e61fa68c1c33c385a3a062c96f50dd813544fbc0bd0d2d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d6a9b66f3c6d63e406cc748632a3c205

SHA1
bd4decb3b015f8b102cbddb453f4dd0c1ff21df7

SHA256
3ec3da4e011759368ea0151fc3b31d102e45aaa56331554ea3ef951863cb07a3

SHA512
4f206a8d435685971014a395332efdd40cbfecbc30dd54715a6f751d09f23681380636bcaaf55b4e655c834194ce51a8b2ab2381529ea3862c6959b4043d914b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
250673b247325659c9d2287c761680a2

SHA1
c5b0c2e86ccd611829e79f2f26ac5f1a64fb62aa

SHA256
5e80ad7939b62269462f02c57c1379fc5c21e3bbca446461e6937a2116f39838

SHA512
597027f8b4b7568cfcc8fe39706f6f614ba0be0a5c8e49242eca1d5b5526e034d4460c47bb923921a6bcd96ec85a3bbff813541a525444de60786bb76a8687d4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
02c3c9b2222a44276958a52ae94c02fb

SHA1
313abf8a3c968d449336425361d351acf0ae074b

SHA256
9adbaefbc90705ea560498120bf885617375b50faf4649ba8925c3d4eae4a53c

SHA512
ea9b144b516e95c99427a88091e7bc206af5408812ddca665b3e9fbc6d5f055dab35ce1a5f0510ad807ee5c9e9872b2e7d4c8926694bb481ca5f04ae65fa2cbb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
103758c857d42d50a2d160074c680390

SHA1
aaa6b748f19865ed20a760c1acde43daf2627c6f

SHA256
7cb7871daffa5727294a08d618f12d5d81465706d33d1695fc8e235a64108a61

SHA512
cfda6924776928091824173d66616d593364bc8b364780514ddf1cee76699d2282bfb1840fdd1d9b03ba28d23710214139937aa1351679aa8e3c91e1d2e3a9b6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f8d68ccfff4fff34704cb889d0714b51

SHA1
d349fc140aa1bcd9c0993b59f3cc1a8cdd9a9bfe

SHA256
420a5a641eea2fbddcbdf6683f48338c958902b4a95694cad7fff2e78fc53458

SHA512
d778a4aa8633192eff34a51b819b51f55a3de0d8186de414972f252134086c5cccb42cb29dd5854f6620f3308ef6b8ac247111d34729c939bba7f0626e20d8b9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3f6a7c682615803789960300d3a79a3c

SHA1
a216b5c3efa1a796b95ac929a652d007f9e164a6

SHA256
929ec61ba9b3b39d45297dc483518abe03be2fe42bd50eecf352b1e8c7356395

SHA512
b7212f4dd993b4102854e9f464e1222554cdea488f9cf0d17388f28fb34a826ab7d07f4847e934f8795d013a83b9dae9a24a9425e4f4fd4ccac682223d9d5846

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
22325ad6b10874ab88bd757229f29103

SHA1
cc5868de99421480e2406acf690dc71fa541a231

SHA256
d179a8d64799918d267f25a8d7b37cd0694001ec67220951d60fb7cdbb20aebc

SHA512
b1c98d297e53456de9e02f587a994e2f18a9282430722dce338bed2871dccede2204cb8c19499d0bb988fbb3f434b0957dbf6252de228c3e377903ce2fc73777

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f8e64cd48e4b4a3366d9c3510d9fbbaa

SHA1
bc2d9afd6059965580fcae0ffb3fa7aeb7d6b393

SHA256
e8a057709acb34bd2591aef0c2ffbafdc73745d1b96f0e7a9d808b8329c2de39

SHA512
56f1d0f0cc46a77b0fe99e0f5e348ba076d5bd5d6e481ce215c7d5db7862dbea35f566da30d38606d5599b739e99c73f19f4e6fc6eefb0bfff1e4088d9426f87

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
caea20bcbf963a59beafb66ada7eaddb

SHA1
2f31382ffb6fda3370bbeeb29838bbd453ae9d1e

SHA256
ca96f035694a70428366cd87d3006b7149f466e12066c1e07eb27b48726b651f

SHA512
e6f3d60302920eb30a8b17f140c41a0f6719f83a4fe2432f5b4315724a1bd3c3070f96f4400e78474479305764ba0cb8278039d9cc5c18e63ddae2d2bb9f3c4e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
dc7d56d8ebe4a4b8b6ad0aa135954912

SHA1
89bb0217cbb070ed560575d849f145fb21a140f2

SHA256
00ea54d2291f87eaab113d809b3b55c6a992e6b98298e88122f7ad777cc072be

SHA512
f6ad9542b0a78ac46ded850f1d4926fc2e3d1f99acef37e5f1ab5c98bc52020485cdda32785d18753cbb8f20c1d439e03fb52ead91844ea1fc225eb6600c334b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
44f37455692872b54bffe27488f6ebda

SHA1
e15c8f6309546b70ec21acdf4c656b939dc97459

SHA256
3758896ceae044d21f533a9451649f03a696deb61b18b294a778c6148d673e3e

SHA512
355649cd2d800b1df43b210e2058726527b38fc52edab3f208a2c01ad36a3e6824c072e4207295921d98a3296877d2e7b24f661e4e951c7c09506387c7fb5900

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ac09c251515cebf684c751d0c88594f8

SHA1
fe3ba6e69db4b490f02a86d59f6753ca5b1c72a3

SHA256
3d6dfc36a7fe9bb414e762db898f176e998c2055b0d86b23287a269bd5ea9db7

SHA512
014d384be12c38558dd18e6cdd04cefbd8f1b7e4b2875f540a476a30e8913249774c77aac8f0f244916c13798df620f6b8ad2e29193248d5016fbed5a3d0a71d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2db41504f9b9789e2bf8b8f050824b21

SHA1
234c90a94a382025fb3ac6a7f2b93a1ecdce01bd

SHA256
ebf67098c56c6a2747f56a6ef7ec27a655b73bb4851b1b04b1349d7168c26eb1

SHA512
1b71c8fcb8a43e6da7dbe77259b63dc3a2aba56fed8da5c8612cac2c21c26af8f868f3754f1d43b2e8815bfbebee6204660bd6e615dc7e71d74c8fee1a2e3b6a

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabEA71.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarEB30.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit