15e26a8595f80de0c12dd7857a4f348378f28527183a867c2ec0fbac2f37ee36

Analysis

max time kernel
119s
max time network
127s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
20/05/2024, 17:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6052a371d1539329a54fcc79a2f0d174_JaffaCakes118.html
Size

37KB
MD5

6052a371d1539329a54fcc79a2f0d174
SHA1

be6f40b95f54e431d73b5af02fdfdff0096201c3
SHA256

15e26a8595f80de0c12dd7857a4f348378f28527183a867c2ec0fbac2f37ee36
SHA512

d506550cac66e36d05f7e1fc9edbc629998b9508d7f1a561e8cfab8769ebe4e5bda9eaacc4c676bc2cb89f41c5f1c30f88fe2320ac5101b5adeaacb42bf6ea4f
SSDEEP

768:SNDSJcjfQTD5Phy2Hwpiu6J2xzmRIRu2cJudN9:SNDSJcjfUPhy2HwpiHJ2xzmRIRu2B

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 80efe196dbaada01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000760f6fb6d7365248881a38bcea68cf8b0000000002000000000010660000000100002000000080832c771d43c68b1af2995e9a7b6b579aa4e6d4f7d8f60c6b62816d661fb40c000000000e8000000002000020000000e23d0796db9dce2bf4694b18453f87dc4ca8530a79857cbb5a4738a445f1d24420000000bc25ab10333359c682fb8f669c329d3f5edadaeac70591a5750c8e0108ad2fa840000000261e728a2b61375ab22f69ca7067b2ab90113f721d8f80eb0e3110d947f23235e708cc4bf0fe8c19e82e1a290b05e9629072a2918d0bda8d578d686bfcacf788	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{C1DDA081-16CE-11EF-805B-F637117826CF} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000760f6fb6d7365248881a38bcea68cf8b000000000200000000001066000000010000200000001abc7a4ab58be01f2464bdac3723f3bbb452abd2eb9893591ccfeb2ce616fc71000000000e8000000002000020000000b054b114bb91357a969013b48914e46c4af14a99a463bb137971ad8ef49414c290000000bcdf79d73410b3eee1803a928dc146aca16ab8ecd5a0c9e074f1d52bf13ca41eb9021626c4418bd234bfcbb3e73f3f4530739da9452059df7a1f2052a9bdbb560a0e5f544c380aff72fdd7b3661b6e07838011a0a758c51dd9350e43985179583dc936bdf1df42eab48dd1567c8dafb7ded1f507f5afac2c77f55d273211d672262a5f9794b594d119f888231182804e40000000827177a824ee55d3810f24e153fb706d4c0b355a56848d7e3703594b8eae7c8c4d9e8f769055ce2d70e08ecb42717d732f664a2b6a3071dba3012d80e86ce523	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422388141"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2436	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2436	iexplore.exe
2436	iexplore.exe
2356	IEXPLORE.EXE
2356	IEXPLORE.EXE
2356	IEXPLORE.EXE
2356	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2436 wrote to memory of 2356	2436	iexplore.exe	28
PID 2436 wrote to memory of 2356	2436	iexplore.exe	28
PID 2436 wrote to memory of 2356	2436	iexplore.exe	28
PID 2436 wrote to memory of 2356	2436	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\6052a371d1539329a54fcc79a2f0d174_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2436
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2436 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2356

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
20ba4a109b2cdd08187f7768d946e0ca

SHA1
f926928071decbf6ad63496d9350304a6bc5a50c

SHA256
d96de39154448fe0544f8efda7c880b0e2121136a6386d61ab6414fee6ea5099

SHA512
895e9a0f75ab6f061eb4ea9b1c2c7d93a22d2801fb8fc3a582995e7f127a51e8ff1af0f2a051d72a9b0169e64a017d7ccfc43c4daf32af7e13e8cd93b7c19855

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
36d6bd5f472e0b2f7a0672d2e6db29f9

SHA1
fbeedf49b8555501796a9fbb92d97736eee7432a

SHA256
0e8dcebad62a1ceb835f7031b75639cda0909649e4ab7618c541ad0230d3f7ee

SHA512
bcfa31f90f4c1075710405e187d8ca44e14f3f3df40b208e236c8fcbbe08f01c955829538404ef75ced12bd454b1c7779a7d3a1b85798de5070f400820cf384a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a4044cebb5173abcc4a585b4b3182dab

SHA1
68057bbf75e5dbf3c326bab2feb984de348003ba

SHA256
9176f1591cd3138689d489b72bf3c17892bf335b7e989a68b2a41e9f05e3b04d

SHA512
846dc60ae2a49a5a51a65c91fc15ef1b00293b341d1fdd1c189955b5d98987b6c7c10802f8029a9303859c181668098ebebe0f12729907c918a5b64601f2d2ca

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
352d51b0a458a300c94dbd53cd8966dc

SHA1
0273bd76e3c0c4a71df06c2906aa433b70352f97

SHA256
27dc599012417eddc00629849e85d7e895375563b2118fd1b087df849c1ce5d8

SHA512
4d07cf357eb36226135b6d269c9e4bb7b56e6a65303559bbe2a41278beac8c4f181a8b84dff02d43cc81820dcfa1c931a11eb27cf314b53d1a95da9859b5c1ce

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d7eb2adcb61b69f4234cd92ed37277ff

SHA1
526a1440e5c88c28bd813625d4c657f5b666cf36

SHA256
902fb7e3c5b19662f4223c1b5327f46a9d4c0e566eac5f32867fa29bc00251f6

SHA512
243811a844dda53ef6262a0a281677712b82461b4e3655a4f1ecd06227b9d7d32eae7d82d52bb33533c6eb6b63d47a7e0cb13b083b6cbda567c53b55744cd02b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5865cd91fba37dc15b2a1993b61578ff

SHA1
67fdaea6344eed49b8910adcc4efcdae212ff75a

SHA256
813a4719a1d2be5e1a07dd59412405d9e3b3012189d269e7e0ff70f0a13eae61

SHA512
ca95dc68b7164b6d5d26c6c9ac8726d42f98c2b98d78005dd1bcb3a130d203586e1e5b0fd3d9ee1846d12fe1de118a4104fe57a46e79152c9a5953db6fc3f01c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9955786f546bf97b49ea176217ab41a0

SHA1
78f9755b58210c1a3acdb4248a8ee1b5e262aa15

SHA256
53fa211963cb76024571e62f30b4173ca7cf9a7e080b023098be0556d37a47a3

SHA512
c9bbe28513a001a3ee443bca0ad8e56936140c08986b5f37d242624f07949229bb42f1e41da3acf80fb3660d43191843453f62a072afc743161875e8e46571e9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5724789fd92df1d6d2d6daf90648d09e

SHA1
449affdcaadedee2240b35c2a09d653a1dde296f

SHA256
8f53eb6483c40d52546655c2453cc803d64298c410fffba70fd9bb7b77513f65

SHA512
ae7c821b3a50e2c4eb759b7ee912a1142da0cdb601f2ec7c1bcf3d6a41eabf3be0cdaa2fdcd73c39cd4f3b4838d1dcf7ddd44eaad672120ba2192d368f06d7a1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
11bef032032b0f8f65233d54cbd8b9c2

SHA1
fa0f74a6e671e9e1d66f1334a07a7bd4d116969a

SHA256
4c173309d015caa61ed7782b56760f996a4907dabceb46695dbea941af71fc30

SHA512
360aec50c251cd897431704bdbaeca82d1c20e3a732ed701d35d59731cac88493fe4e2334891833f92ce5e06baeb4125d7054b04d399aa548ca776595782ab8a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
880f5c7dc6e94a5257275d12868fd66f

SHA1
50334438f98ff7d33e688448bca8eea2b37db3e9

SHA256
82d0f785db9080d36acf73e0bf3e52e2ad2802a91d44d1e1e5f25a02137afeef

SHA512
27f6e2f7fd7f427b8ebdb57e3307f36ce06dd73bc6de48983c5c0646438257c2d554385b926e2fe6099a192a18b0da5144a0a852d60d06102671268c8bbad275

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
15dfb43742f97eeea6eb6b2b92e67d12

SHA1
8c0b821f158de7522b9da7d0fd013c3afb4978a9

SHA256
137e4bdf95e8e949ef565400fdf728bce951e05f2809017afc71b6ca73bd8700

SHA512
4c28f4cc7e4429d5ba197a4786574d8fd2380b4041e80642349c931dda103a0a9de0c4100bc62d2380fb704640ad3398436de8139cb1b79ebde7b73744334f6e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1205c41770e4e7c109914c4e4550a74c

SHA1
7c801017b566c24ef5b46f290f1491cb80aa3f04

SHA256
df96cadd45eea7913a014903490843edef5d291170439e217a022f1cecd27194

SHA512
a550378039514fd43b6528e1293049030c6e1e73a2140a58e1e44893a2aa34f89b94df40fe0de72303ff6cc84bcd9feac1d74f243d345eff915fcd17cfda7235

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
225983d19ddeaa26333074144c94fb56

SHA1
b998d87c54b2c4719ea83aba4025b8fc82d5180a

SHA256
fdfa477ab39439fa54a228effeef8e63050662810cd197ceca5fb4694e463e88

SHA512
e2d56fa3420ce5addf5b2d85f184b0f0d12d8c56f1b62fc661c8aa87a53f7fe9873dda83eb84ab3fcfc7692a0bb6ca8ec6fb8cede76c724da5d58fa663234952

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e654413fbefe501736917f7f28536d1a

SHA1
2d9d678eb1af64bfd98240c610a8fe28ac9cf589

SHA256
6af4ce86edc6f8b7554985706e86fd3c8bfe9131a91b92356207767f946239b5

SHA512
871afd94829e7f174179e8f9b2ed10e6d20483f2618bcefddc1fca86cb229e8eb493a9111bf89e2d390d6d796c17974e956949850de7be17cf2cffb2394b380c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab2C22.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar2C21.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit