70427a6056873039f3cfb1cb93bec38aa63343b169f23b04debf77763ef84f33

Analysis

max time kernel
133s
max time network
130s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
20/05/2024, 10:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

5ea17152ca29279b8eb1dd9acd28e225_JaffaCakes118.html
Size

69KB
MD5

5ea17152ca29279b8eb1dd9acd28e225
SHA1

d0a1a60be67d156aba269d058d4a1d441c01fcc2
SHA256

70427a6056873039f3cfb1cb93bec38aa63343b169f23b04debf77763ef84f33
SHA512

c933a94c516995ccb97559958659d30948abc38c8895ce11dc3db047d996bc9200191315e4eb7f7069e6222f9c113be9771cc7a6fbc4973c23529c4a87ebeed3
SSDEEP

768:JizgcMWR3sI2PDDnd0g6RAvez8ItZh5Z5D+U5GsoT2e1wCZkoTyMdtbBnfBgN8/m:JfRTTNen0tbrga90hc+NnhVJ

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 106b4cc4a1aada01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{EFADBBB1-1694-11EF-B04F-52AF0AAB4D51} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bd2a7708e9798e4fa0b20f3efd8e936100000000020000000000106600000001000020000000ffa29e29eb7dc52eed004c8a669ef045c530496d7ac84ed81dcbe7cbd4c347a3000000000e8000000002000020000000e8e9d2c6a44ab0371725ef2f3ee412d1ea0bb425765cb849217414f8407f83c9200000001f05fbf1e3d15fe416afde5bc80d1900e040b51ffe93ff4a525c540704ddb8fc40000000cec22865bd986fb89b81ee4906bab08655480270a1b3022a7028945b0326f6d382b8b2aaf663580dec4ed31b2e86626d53843a8bf4fc3fb2b137417adb52e8bc	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422363308"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bd2a7708e9798e4fa0b20f3efd8e936100000000020000000000106600000001000020000000e7547920472bd534c10d122edd647218b0542e0b1ff0b32b0d502f09f2db6642000000000e80000000020000200000002ab2572c1667eac0a8297246cdd26b927521908e4cfb295f16bdac069ccb9db29000000057561e2bc22c595deda846ee938290444ec58da86a07b377268eaceef149af16f445cdf22d918c4e167480dcec69a53b84a2a5cbb086a35d960fcbbdcfee8d3b84aa864d3b4edd4822accb6e27dd17e90e7a0f7abf5d40d11f856a6c296387c04031adc6812b84980ae2a48d53217e13010550aa3e25d94ab17fb3c336b0c97f834669220a15c8628c5b3fa545f3c370400000006e4dada26edf1241325261617e9c30f9d82553ede3537f33502a06cc1444c1ab3d3e826dfb0e7b17c4f70faa343d8df2960f8de4e95d080406ee7c20f3d207a3	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1844	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1844	iexplore.exe
1844	iexplore.exe
2980	IEXPLORE.EXE
2980	IEXPLORE.EXE
2980	IEXPLORE.EXE
2980	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1844 wrote to memory of 2980	1844	iexplore.exe	28
PID 1844 wrote to memory of 2980	1844	iexplore.exe	28
PID 1844 wrote to memory of 2980	1844	iexplore.exe	28
PID 1844 wrote to memory of 2980	1844	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\5ea17152ca29279b8eb1dd9acd28e225_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1844
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1844 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2980

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
229c10b5b175ae5a159aa47d3653e5c5

SHA1
e0610cf676f10661f22311bbad862a774fe192d9

SHA256
a70c14c1cdbe9fd8dd8df232bc9cad114d35b9cd1fda5ac7369a91f6fd5cc8e3

SHA512
72665a10e6fd9057819542ab4e0393b0d4a21adbf6075651f7d8a2e9cd79f7ce31e4f3323b3a2d0c4d918c2d607bdd52e37c78023794ef1ba7cfab337c181181

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1d2d511f5f1fe1334b2db0620383529a

SHA1
76db07b792a1e6e64477525c9b3e63f8a317ec6a

SHA256
ca8cdd5f60f408634b73ea4bb7bc450e3dc01e64d38604e9936f317e7e921d5e

SHA512
6df892cec5b4c548a30cc70d308eca12345c8de5d3e3f3172563469ef7a66e86a636475a75724c1f0c3fbdee1c30d3c253cef4cb1f2fcdf01dcaed5b845ec744

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f0555ef1dd0c85b8e5e3c351b20d11c6

SHA1
95004dda820708a235983cb2b438387c2575f093

SHA256
c9720dd31d0bf5b3237d3e7282915f3c4414c9925544139b84a0ddc3d023b4d1

SHA512
53862a75b24859f90676ff8daf41987f034196ff0cb0bd8ca9ea0711bc462b266d455a622512da528ba7f1ca1b9cdfdbcbb5e66b402261735078192f43216496

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c4967491babef6903018f3937f7af114

SHA1
f15cc76b36a3895ee5b8bfa279a5015170bc87da

SHA256
9f42aa3268a7b1312525d8ca3371e144a645361e71ea4874038f7bdd417d06eb

SHA512
4e978649abe35ce4c9ed7fdf59b8d338ef3130afde1ac5319ef98d278b90050a718134d419a745e21fc2c5c5510656e336691354a8cded71fedf28404d264bf0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d18b35fb1ecc1a66aaf8b9e5605eb21b

SHA1
1e9ba696495a55290743cbeb88cd329c02ba82c2

SHA256
287e23dda6c677f8667e5ac10cc68fede191c440aa197f23bd56ec9bfb721c18

SHA512
a8701f7a63013aa27f8ec95cf371007055699d0849439aed5e08d4ab8f1bd2cdd6ce1bc775924b358457e29e3b8fe9bf8a4a1beed37b92f8ae7fa50131f00054

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c324e82bd95961f2b4353e5192745148

SHA1
92746a47e1c165d66edfb5515e61ec818fd15daa

SHA256
8d61f7db897ddd2a6e8a576d8fc02f43f7699baa8e0cc3513561ac6a58670fc4

SHA512
5ae97509ade91f78e748cedf81870d7ecaa18fd73fb45922be6b8be9130296aabdba48be4d23df92a11fcc5239ff48d7dad73903e5244323872cd0499f6ebe53

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
aeaa5ac0406b8ba89b0ab0780f3d2441

SHA1
efd906f52d9469ea27982a3d7a8a653897a2c032

SHA256
fa92d5e4aaf4669781ebe04d30e15d679b60b76fb71d04524e9106546005a457

SHA512
d5af11cddc5315e02a28fccec7d407a3d9cc12ed97ffbf55048d6f13597bb5c7bb9d1b353527aa5dc41f58186b99c85240fed2a8a88883e4b4e3d59cd1338a6d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
82ccd871bf8b735ec060d17edf0212ec

SHA1
1e595c04c791b165f366851069507ae6499b0128

SHA256
59902592275066947c420d0751c4b58e3f8e4d5552db8bd0e4e1a79cc20d7262

SHA512
7e38fd0dbf1a604fdfe95609e73cd6a671211793571e1972a70fd39297263440b7d83b0e7ea346de99ba1f6dd287700bfa824790689d01fc2256dc4dd28ff949

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
90dfa1ddba6f4f99f7199fc87a095d1f

SHA1
b353cf0a7ef825395a9999c7e253dd223db5c214

SHA256
1c1afb7865a31f18232cb49705ab15c8eef25bca0c9c450f120f926659447663

SHA512
3f1d49e612227fd3af601bed1a285a5ab6da3079e24cccd88009bd6ed07a93eb92183b992f572e524efea02bf61fa475d85cea9976b6e551b22b2fa944571273

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5ababce187559bb33e0bd6865cc8d9fb

SHA1
74dc897d7af6e1eb4bdc6a48e9afbf2df35c11c3

SHA256
18d09517ae7c3e6915d647ab6b253b7f0617853c05d3ea020b9c167de6f91c74

SHA512
3f3b3ef9d3e17a15b63bc6d19c1be7ff90ad91ead6210d932096d8d8b946e9b711c9554055212154f86366072f89218223ab224d96f2a149f7f97cf7e9e5c7b8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
12fc92f500c077f36f916aea5d26d525

SHA1
cd91d317ce08ceaf72360084a270f5dcc60a0ac0

SHA256
dd54dd6248a90ebf41ea17a6e0ed02f7671eb4883b2a3786a3fc77e2a31f92dc

SHA512
5ad38b28ee2995054a81e724752001a14944365902ea71cb40622476e4824b2a7d67cdb6a6ac0270ffbceba06d80aa6f651bb16f64864d545dd8742584b0986a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab389F.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar3910.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit