856c07f94f5159e1431e00c24f33690b479c932b9d45379ee9308d322d721cd1

Analysis

max time kernel
122s
max time network
127s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
17/05/2024, 19:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

510310df8012391d56fe8dc7ee8f36f4_JaffaCakes118.html
Size

461KB
MD5

510310df8012391d56fe8dc7ee8f36f4
SHA1

c9f9f0d932873eff392c28a6c5727b0d649578f8
SHA256

856c07f94f5159e1431e00c24f33690b479c932b9d45379ee9308d322d721cd1
SHA512

66d28196281e66ad3c93e2b6b94435ef1e55943f563d544a1c91ee25a130ea17f218336d464710089db55811db7ebe888a8a80861ab6367e4a93e1c7d2488e44
SSDEEP

6144:SYsMYod+X3oI+YIsMYod+X3oI+Y1sMYod+X3oI+YLsMYod+X3oI+YQ:z5d+X3Y5d+X3z5d+X315d+X3+

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bd2a7708e9798e4fa0b20f3efd8e93610000000002000000000010660000000100002000000074a305f98b01124db87e2470da98380ee9528ae242b1253265da5c22a3c32931000000000e8000000002000020000000b12d79f6b67a077cb710c8bffdf30fec839ce6cc63c508bac58601587d4a319820000000212c04973b10254badcb521586f9a8b35fd30f554dfb2685cae6af140678037440000000e2d365d8bb1609f26fc46534119de73eec4a764a2622f87f1c3fd87a3f6a3c17e423395a3d35826a9cbd1a90a36654fb2d17b6f44790198537a329d7b9207f81	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 609c3cf18ca8da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{18AA7381-1480-11EF-A759-F637117826CF} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422134454"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bd2a7708e9798e4fa0b20f3efd8e936100000000020000000000106600000001000020000000d14fd23d065c094d29932a390e09b1fd228fe2f85b427e39cd258cba3923ca8d000000000e80000000020000200000001f01a36e18065d4d26d050b03e755eee639bc1f98da31e5c1f3ef0efe496fce0900000000d4557eb00bf701b3776ad65059de673838b882ba18e19fc39b933e8b3ec3f1e7022df9ebc0b80ef1076fc668e4be1d444bc7229c16e7ad22719679703d4dde578d32db89075d3045fa6b99bb74051874592d00b7a770f2a3d91588dcc58b4a9e76ea129aa2b917860ea669c5d01a2ca96afb29a6fd4ca37dfd1a91f0e550623236475b6084d34b2d6d34f688eb5413b40000000a13638459a031758e755ddbc540be12281f4d608974b00eb78111bfd25cabda5905c0822e42f295624e2d7b79d1033b354ee7d34b3b5b623bc7a4c372c3e6838	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1936	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1936	iexplore.exe
1936	iexplore.exe
2016	IEXPLORE.EXE
2016	IEXPLORE.EXE
2016	IEXPLORE.EXE
2016	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1936 wrote to memory of 2016	1936	iexplore.exe	28
PID 1936 wrote to memory of 2016	1936	iexplore.exe	28
PID 1936 wrote to memory of 2016	1936	iexplore.exe	28
PID 1936 wrote to memory of 2016	1936	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\510310df8012391d56fe8dc7ee8f36f4_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1936
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1936 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2016

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
aa3e09ec121375e4f4cde633031c5008

SHA1
a91dad250f17d4ed0703e23e16432d7860c2387e

SHA256
4065a99ee9e119d43710a6c82f9110527b807360ef4157be9524c718ce0d0719

SHA512
d309e114042cb09f9562221ed24195c868bfc84c85f1cf4faad19a116545cc22a9fa230c0cc465ccfd11ea988917a4836f1f42e4b9f1cd1b5ac702b1c0593686

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5d46fff58dcd5c504cae1a0bc204ccd8

SHA1
328ff76ca57fe73f579138b652bd4a762e394a53

SHA256
b71d86defcc6ece6125620a2be78dddf1089aff40ffacdb2511ee2c991422ee1

SHA512
b9f3db181e2823f6ed50f54ad02bef797ccb5720c2cd7374ab119b049d5ab45291b8870c1bb1d540c594adcafc5293dd1374bc61193cedd62f77017fdbe19871

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
63760ab845d3215609273a854fa71b02

SHA1
26598405344239073bd5df57e783822319e3d1a4

SHA256
37f04251538bb71327c1d345cdabd8fb3cf26dfe4ee68685153629c9211f046f

SHA512
765e5e71609d58b109dc11f2beb2960f1e5ef2cf48372a03c026f6126ada76d10486382ac1ffa0d35b76f7a67cb8410f4d31cb7b98a221defcb4369387f59c28

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2cf65e7edd5d632e4642d755608eca9c

SHA1
ebc5f42fabb6321e7e4c5786e0a6eee635376f94

SHA256
51c36e6a40861d57274fe0a476f9787b1d2be94bd9c665f0a50c12ea659551c8

SHA512
9f6e3588ad3fcf959424dfd15041ddb5b809641cea076d45340d8e6b3744fae44b6d3dbc73ddc03cf97886fdbac37d1f1187ff838b68f67f165125af569d1572

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3e70f1435379ab8e7651d41ac6d6bb5c

SHA1
ae4c827fe573cf073580eb7350b8a11ba6afd154

SHA256
044671d4e07e954664ee80c285ffc1de78ae554a3063c82e6b6744ef0850cbfc

SHA512
33d5585897fc7d2204095eff668220560e4e7d305bd40dad48e311de49dfd66075dfb55472524f9f5980cc2356d07447a1bf3978e279ed9e84f44449ca34cf3f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b4bfa9afd3653b1338763cecdf80c8f6

SHA1
55454d56cc4ce1b0aea41490b86a12a30eecc9f9

SHA256
bfca3a26c89705e8af46bdc1f62d5aaccb6d0be7b42b2cdda1af7847673d7be1

SHA512
09ef301e2d8e0d32f56aad905dbfcdcf6ada188a5f987cb63b2b21434bc47575a43dfd459c76e2017d4f3003d4a5e76789ecc690e1abd5c91cb2dc8606c5856b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0137eccbc8fba114b401d65f92ffc8e6

SHA1
8347123d65906bf17286fa8286386864840956a7

SHA256
4b3498ec5ecc264f985a2281f96003bf3582a561f8a3c25bafe18b2d23669a6f

SHA512
b0d4a9f39c763a0f296656e6176aba85757c60a6dc85f3d9565c2e5e0b8846a6f0149830d04fc8ed6c496de372f7e7c863e34943b8cc7c90de6d32bbf9a4ad82

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fee5555e4c0b6861e9b16761b80275c6

SHA1
64df6da78be9262288bbe821431d7d81c8f74c19

SHA256
439af93ba12fa1e8ff4c0c7319f30c35765d3fcf8422be3c32ee5651a9ced09b

SHA512
7f7ab1806fb93370b290a2d6bcedc9bef9c30d11effaa9caf11b58731311c68f90515c6e968ef99a52e3e14b779179ae168c3a13afb7979e2e953b34da950901

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
be8e99ee1c7c76eb9414bd39d6e8d48f

SHA1
50f7823edf8a47999493d95c60de4e3dda43edca

SHA256
e609eb163ee9d84af3a7c08f9ed54ade360acb9e6e37a95bfce1e2aee78385a9

SHA512
238223c50272b73955c37166df51aa9e1ec2a10d4b2efccad1b91f3257e6d768fe4377081d26e4eeba321c6183f4c07d42e7569d07324b69d6d32ce62e7a2093

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9ab94d00da8ed36a176ae468845944ee

SHA1
501b8b5fc7e881b20ac9cbf329510f2bf306b74b

SHA256
0447643590a3e821b8cb5731503c02fcacd852cc817dfcbf5209d4856707ecec

SHA512
0c101e695e0fdb924b63d008b1be3a850e9b09e554c31ad6b9d6eb644a60f53ca2bdfdcd33311ee12163a12c705c8d2b14f1b883c9ba2abb58a08a32d35566f2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
10f3a507f0cd4b3ee5bcfcd91a5f5bbd

SHA1
6498531dbb2514fa7f76ebb0a4ba67ad56280e5d

SHA256
b5a847b4dec066093e3187af7f9e5ebcdc231245211dc1eb6c81f31924bcfb7a

SHA512
7ff126dc5f2159bd9486a9b9036e1b5451b991e1738f628cb0841e116154bbdda92ce58fdb1d62db2ef2778092f4856827f55f2420c97f48829817bb55ded8a6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b734249d28278739fb892e81f17c5fb8

SHA1
8778cd82d3085c0a7c630d80de406e74ede87a30

SHA256
5837622d74a4363b66bfafd3be69606f0b42e4d56ba7126068a1e850b970f8bd

SHA512
68bed456278ad919e30a55a439e2e478487ec82a81441d054cae9dccc09998ea04b0f660b1a3cef44cec888300a7ad5891d552cc2d5035e4d5a73b5f493c21f6

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab4C8C.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar58D0.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit