24fd49e1cbd4dce4453687203c749eb3e975cb586d1a94f9890525f666215fb5

Analysis

max time kernel
121s
max time network
129s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
08/05/2024, 12:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

24be8fd089b20dfa66d12d6c1a73779a_JaffaCakes118.html
Size

4KB
MD5

24be8fd089b20dfa66d12d6c1a73779a
SHA1

674755d7adc1307d8ef0db2e3d5d426049b70122
SHA256

24fd49e1cbd4dce4453687203c749eb3e975cb586d1a94f9890525f666215fb5
SHA512

f4bf1fcb3bb4b6ef1d497b5de2ebe569372748e1d40c7e0db8ebe8561712da983c99d3f68d2edad80730347510d9f105fb4d9aa03552d4289df047a0da4cde83
SSDEEP

96:Pk7yJozTGknaEFHVKDZTBJl7sNjtXATIQFMA5e3fhrvDJUgwa71D5iJ8oLu0YtBd:Pk7yY1aEFHVKtF37sNjtXATIQFM93pDf

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000009b106788dea7af4d98683a8983feb7c600000000020000000000106600000001000020000000ed9233b85b6574859ea18586d7efd2e605dbbd80c6568697e3b205d8fb783d88000000000e8000000002000020000000f3ecb3a3a84b9f20cc31c08fdd41cb7114570a71796cb7f9cc47e4310dca8d949000000059ff6f8685851aca18fe92944a128a5f60d2d6471e71f2df017291e3bdc27cb70c937841fbc3e125ea7b4f9bae508a76095267c6d2fd5e3e1bc04b8df9774055d93ffa4d66c4cb88e4d632101c91af064daf288a3230d090013f136ebe0fabc32b71525711cd36d24cbcbc26b34f3cacac88e7412e32a735898c99f620593ef5b47290455a6b611cf4696c64487293214000000023e67cdbb24e95b18a3f464728e4d9b32b9e73fab763a6b77207feb9cbad31ab51eb4619ff98c7ceddf3e0ee2dffd357afd2f84ec8c3b4425af87fc13046e5b0	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 800b345b3fa1da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000009b106788dea7af4d98683a8983feb7c600000000020000000000106600000001000020000000af648f7f7695761506df0497566fe823225ed8d4c6894c37fa52f4a59ff5fb8a000000000e8000000002000020000000af1ae827c644cb20486b45df729d21c5e227c3c3206701c85f0a45e17a7017a6200000005fd623ace213f535471b808f57f0945eebb3b5b76a7a275d9ceaca62553b6769400000006f2741e954159cc1606984a91ea8db7b054937aae4ff4a8cf8a081fbfc10dffc223dc7b00a784c8ffa964861739134cbe00cedfb188a57d4577355a236387173	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{86CB0281-0D32-11EF-9001-CA5596DD87F4} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421331482"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2896	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2896	iexplore.exe
2896	iexplore.exe
2260	IEXPLORE.EXE
2260	IEXPLORE.EXE
2260	IEXPLORE.EXE
2260	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2896 wrote to memory of 2260	2896	iexplore.exe	28
PID 2896 wrote to memory of 2260	2896	iexplore.exe	28
PID 2896 wrote to memory of 2260	2896	iexplore.exe	28
PID 2896 wrote to memory of 2260	2896	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\24be8fd089b20dfa66d12d6c1a73779a_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2896
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2896 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2260

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1f36990ea2aa4c4aabd017d5cba33d98

SHA1
134e0676e415c27a578c41b3b387d2f42025130a

SHA256
1cf36c13e568f620313d06be69add92ff2fd9711fcdd98bcb69984571472e89b

SHA512
7b02287827539ed5369232f297913c61f6c3c8a24aef96ab27e60b3c860f7c8335c3424d3df85d1592f0b8f0de42b78559de161397d4ea2ab9c13e8d4c3da3f5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b61ab27a446cee961cbbc9b6ac8d1146

SHA1
d35a940dc10fbc20c90f30caee9874d6e85366ad

SHA256
4f8547b7f29b3060ce09e1498016a28ec3cf73ebf7c969b53ad709636dfcf48c

SHA512
779d3715d643d64c79c6270df7d0c38e664c6df22a469f7ca8a90c72d88b142ea605798adec9c750cdee3e6977311d0666bd62b48c08256216e8cc6f56686da5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5e3e5f5109b44769127073487f19e662

SHA1
94e2f1b95334bfd54098b5944d9b90e48a35edeb

SHA256
6ff045fc0f3ad407bc7606b0863d84ac9f564a4f89df4744f9b684a115836bea

SHA512
3fa8f7c3168e38019f7336e78752f9ed525ae05372d15bc2c07fb02706af069e60ca8b1be06aa606ab803e372661fc4a35337c13032e09b75b3be8d69c85a2f5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bd6f0bd60ffb2eb9d4498da17d49cba2

SHA1
46a4fdae8ebaa87238e5d31947521e7ca1e48929

SHA256
9ced45562d6f98beca1f40b475f57f42581c6716330f6c14762edc4b4869dd84

SHA512
c911670c4ee971ce1abc36b19e4a66607bf8f01ec09fa8fbaa2112d2898f631442c3a6dc3a92a46f7cf49a2832589d5dcd59b24099cf8e0ff7cd6075f8f10020

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0da920461e2ada2ab5e0f659f1083ab1

SHA1
3c7d7900fee2bdde5d031b4c161711a616652d81

SHA256
e207f644132c828e439a7cfdd99e4ea38862b3ad706c52bb570bd2a2fbffc62d

SHA512
a453d4c2553a40f583e0c93e8d3c1a415f035b0b2bbe08caff2d30f9c5380b496e9e16811162511268e645f723235cdf07b70bc0332af428c50443a7a31626b0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ce86e5889a4b36c9553f8a425af0c942

SHA1
acd1198b20923cb70f030a07e9aeb12d27132efe

SHA256
1ad63d9071e5b23d069e56248055c3078d2551a8ce15bddc0aa535df97b10cfc

SHA512
44616795c7f8593b20ecc3db707a57dae8698cd9aa9de53ed83c942f14be6a4b01e4711d0f5b58614ec7df9791e304bf9e2a8dd062c0225d9b8ff892c5ed4852

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8c602181d626457b5e219b896f7a5070

SHA1
eaf526b4519071cacd1a1bbd864b5327e8ebc365

SHA256
37a7925c92104e03700abed4ff7ac83eca52398e94363885d0f441e1f7fd02b0

SHA512
9bb548bba71ded4fc216b6ddf671331fdd7a9698b90db254d48a3fa7d642f1305c7512c67799e18a671ce5e36fa99323f24c8767c835ec1495ff0a19620871be

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9d9f0e81edd770a0b15f4d46a786134c

SHA1
f04fe95da4accd1febfecac6057a72817a1206a9

SHA256
5b454f5a9af2e79614e63fe6e7ab16a1f4ce1e2dac951818406e7262b474e312

SHA512
6aba9e28408e8e89238270d7c34d41a5fa4b91fbe1362fe552555e68ef775806e92fe09b31bff7b4c5f9101af6e6df362fd87d11a14982d9e2da89a1e578f97c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f6d5e03ec9d87961473818e57ef48277

SHA1
b4505edb6aab11e4303e353f77fb05b946b02c53

SHA256
7d7d958c9fe279508de64939b6819faa55f4fa3e44adf8a75be282336898ff54

SHA512
c0fca3c4f4d67d719be2683baf5eaabe86de7cd35b89e9c20a5cbd42fd9c09080f18060158cb9c62fddbd95c10bfd7c584ac896c7d8dd1294b57d018fdcb2b2b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2b24934756e1d832e82dc9757b056eb6

SHA1
4dbcdd9a88f808a664992139431e5f019c7ba082

SHA256
acfcd897d6fe9f6a16f6475ffa2ecacc77d480a30f7467445a2de08cbb7ce969

SHA512
2b3f3f6f38248a501e9c4dd0453aa3e5bba0b5aff82d3251c2240f5cf7f49a8155cfeb1d335246a45b393c4283916841080d8c354e4e7eb32673bd4a864bd462

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab33A1.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar3962.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit