6a4a0a520d2a503c895230bef9c3a03055a9ccbca041d0b45787074bc956d666

Analysis

max time kernel
119s
max time network
132s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
22/05/2024, 23:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

690444cce5f30dc5b152b2d000985d0e_JaffaCakes118.html
Size

460KB
MD5

690444cce5f30dc5b152b2d000985d0e
SHA1

6d62eb68c722dc533372845fb4484e776108c6cd
SHA256

6a4a0a520d2a503c895230bef9c3a03055a9ccbca041d0b45787074bc956d666
SHA512

0979bc517808950de77fd512523897d4cbfda75ae3a2f61da07a9b4737e908d00e0d7c83704f0c387d94e6f83a7b41da7935405c40cb499e31fdae0ae33d4759
SSDEEP

6144:SosMYod+X3oI+YHQDsMYod+X3oI+YxsMYod+X3oI+YLsMYod+X3oI+YQ:/5d+X3+5d+X3r5d+X315d+X3+

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000003ee023385766ab46afc41190724ef80a000000000200000000001066000000010000200000008f12f743ccc2660791066fccb72b7edf416519349b632bf780e0f519e897fd78000000000e80000000020000200000001129ae3773c04fb127f7b4ee661ba0d7564f3c87e2b678d1c97506709584160c20000000accaea61c5efbfa59ee205eed5c914033f269c5e0f0264f956e4c263d3f34223400000003964c8b05d971d26f75fd81d73858b763ba4269721710559768f53a1abb1edc5d2e2b1d7021deee027866a399553c94184c9146555a50b3f84e569a2506ed818	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{11762AB1-1894-11EF-8698-5E73522EB9B5} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000003ee023385766ab46afc41190724ef80a00000000020000000000106600000001000020000000a66125a77ea7bffe1571064ef63e7b198c1ca6edeb9c1a05bea1a797504e6422000000000e80000000020000200000000d3205c4662da5c9da5b814d798229ad2c98b265ba80b57d920c92f2c9aaff6e90000000cc6ca299cc78c5c61d85041fc93d42feb8fa321c57dc13e77df53ecc29937b6415e8ee69b9602658526f37ca96d37685ba72b4c493208f0134da8de3926b694d4542a63f8c77262bea3bde50195b1d8ec44ab8d607437e16416dbe3436e4d16620c32313d9c20fc16d689d4f560f47e359b52975d41e26e791b1b8fedf7855891d4f83514df62ad195030778165283f04000000034f55deca0509ffb41951803c6f8b02a0112937ad0ad90abe257719f3f9dc341da048e442a0f0852a53195714b21dc741795ab57a95342de5057b70144e491ea	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422582838"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 203686eaa0acda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2804	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2804	iexplore.exe
2804	iexplore.exe
2204	IEXPLORE.EXE
2204	IEXPLORE.EXE
2204	IEXPLORE.EXE
2204	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2804 wrote to memory of 2204	2804	iexplore.exe	28
PID 2804 wrote to memory of 2204	2804	iexplore.exe	28
PID 2804 wrote to memory of 2204	2804	iexplore.exe	28
PID 2804 wrote to memory of 2204	2804	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\690444cce5f30dc5b152b2d000985d0e_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2804
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2804 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2204

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a21ab163d04317056468c598f40e4a45

SHA1
fee58c21375fdb65b18de4a0c6b1c904aa9a179b

SHA256
06eb3722ba89f33da281d7931ddb9112b8501e29f9465d84cd46a5b4e1da2d7d

SHA512
f5e67c050de6bce2513f4dbaca9e0975584cf815b5c4d02839cc8e743964104e9311434a59c10fc1297cc9daf30020991e8a2244906ea978bc41789593414531

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b9e24ecfdfcd5de0f8b1bc26dd44e832

SHA1
862d413032f0dc59a08ab25b1d5ffe6c92a8acdc

SHA256
9c38c6e3678fc33d0b032081fb7fe69a18ed7feacc7b8923bda47e595f23dd7b

SHA512
6a3b13b88b6ee776e67b4545efbae1528b7b8da1dc9ac71d7e5d2d8c5347786ba35bf40fd9a95e336ca6b22270c9bdff4e7149e58ffdcc8821b77e7464c21748

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4fb6990638d9ad4c53cfbaccde396b65

SHA1
20b322bf2bec310123a4fb1a8723e0878a528c4d

SHA256
17eba6b570bf7da01a75e03281f0aea8c1fcb3fe83539306b5f4881dc28312de

SHA512
f8aad7ee1b836c3917575a5cadbdcf0cc850702dcb2d510c55095b95b7e4e71ea825413bb55136090c80ca260128ab49ce46fe6571e02a9c2f9abc96aade6a98

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
04131e937b21226960968ca434204952

SHA1
0e6ce82644844495d8524d202fc0511d5057211e

SHA256
27c9b4942d03033e74add6bdd29b375dbd451961465d5a3bf8ae20aaa2b44874

SHA512
c8de6953f984d9b549214d9430ecce7c8b3f0f324bd7364afa4d655dfb30ce2a389e5954db28fcaaa695a5f240871e0b941551f9b6c13ad739aad7e3cb795b51

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d09294e3fa44955f0fc2203cff678bbc

SHA1
363f5e551d4406c7aa6fcc5bf2e3e7fdf438c043

SHA256
0761ffb5fc26f9671025cff944a01992790edaaa1b8bd0f3304ca1c989f9d9a4

SHA512
369f21a0328e42afea7f4592dc5fdab474ce5b3012e5d990f923e3700cb6c815586344744607fe2b7e220b011fc2052e5d0644e6301bacd110a886568c38cb4c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8fcd1c3b4bec5469abbbbdc0726ae34f

SHA1
83fc5908e5373667b7d5ea35b60acab8443c1e0c

SHA256
5b74b79f25f4efda1d35f8abe27773e9bed85b54ff430ef8b363e5507a02c963

SHA512
209081fbdaab3ca06973930768527426514349b6d1f1a0595a0ed8043d397d8a5b2fe6ceaa1d23f24897122b3de866ef2eefb813ed7800b50269d0ccc66b0470

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e52c4d81ff172dd9b0fe916ed4ed719a

SHA1
70e7cb3d618ed1d4c375db6f7d7ae6d4fd86a903

SHA256
b9710f7513dd84a214070666831fbc66729dcd9ec358769c99ab9ce8f50c2266

SHA512
1e245ec6ccd05b82dfa9ec15d41f4757c9dff834423f5c5a4a426735d388f7b80fe26e20acbeed4d1c9a7433dcb2563fd81f8ac39c5eea498a3e139351bab229

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2628acb01912c36e3ee87b1509b173c1

SHA1
4f669e305a696125b53fbddf810d8dd7945865ad

SHA256
7ad30efaefdd8f848df77cde74b4d6bfc82af0097ba9f780c47e6e71c93efe0b

SHA512
2f7b793118c7b00149a23ae6e165e888f8b4a8e70157e7978d54be366be2d3fc44186e21f72b8054005935172e012b7ca6ad010ae0eed2ac855fc85ffa1587f8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
44e5006c85b6a661426abc581824515b

SHA1
04ad74014fa78aafac72c13b552489a19c737eae

SHA256
7a22824a83de53d84f4b9d3a7d9604123d0a49459f501a057b8d870d10f04f50

SHA512
f77e795eb1ed9f425b885391ffbacc53fcb5a948804f8c17a63d6c75fed2e9adaebe9d21134f3a9cfaad0d44b86c3a6a4696eaa08f8300f2a2b303cc1f417956

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
350744b751cab1673e32875f299d69a8

SHA1
b3294bb2917f911d5480d7e845973822bddfc0fd

SHA256
24a335869fdf07ca2bcc03a9f537cd3c95bdf468ed64e826dcb6f7d6498c0c65

SHA512
fcc2ae3376074dce52e9fd86207cc47aac0611380592afcf921e91160cc35daf5db855453275d7b0992f9b76aac960ced76cac3ca24f67deefc2797cab731942

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
336d9dd8e11ff80b5d1020bf305da69f

SHA1
51d42d32fe09673083f3ec23324e82983a083d48

SHA256
cbd6604f61f6f1b28063117e94d9fa4b6bbfd8184cb68a413e83d31700d36d72

SHA512
f466670e165c38a0010bfa7a1d0adf010876327c049eee556b5cc1e6abb5833f3736bc0666257a7a7909573ff1307fc24d3fb3bc33f44bbfa513f93a65dec8a1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c642699234fa0b0bdbaff2205d3df3c4

SHA1
334f03223452ed2dece6944a40355c71c6cfc8b1

SHA256
6631cc8deb2e1dc05db4f1e0bba940f8e683581529971c714f09c0504858f3c4

SHA512
6c37fbbd1db28b1073795025ee0959adf5a72875534ef2fefba08b82dc6f048090e8ca7ba59e8c9f2c5494b76b603e201d06518e27344e9c2e69b1cc09cdf9fc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
153c1a43a6f1a829ce77daa37204b766

SHA1
731d2850ed519a265158cb6744bf703b8a83e603

SHA256
e191b88435bd090df1914bfca14de7020acf6641202e2ff78820b2786e07fc25

SHA512
f49e6cedebe79e46fac1b731845aa639c47fadd4f2336edabc37b610dc9f5b6daae4ab7b748c6d513df0c84a3a0e274e87977ee1626d00477ae88fa7dc2fb510

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2832c296693db1eedb328cb76cc7e1d9

SHA1
07e963ffeb4065b9b0952ba2cb432dba1ecd58b1

SHA256
0282bb6cf2906f4db8af3f1a1f487bee4aade7dcde65d1aa5b4cf543fb664ca9

SHA512
510125f8fad91084e646dc295d08dfdcf5d22158b833dfd39e0a3756c15465ae7f890fc3c3dde8e7ba3cef83f5e6685606dc20d142f77b95046047ab4a798bda

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a3534afa086656c139590ea93fcbfd82

SHA1
6dbaed714b6d3c3bf5f9a9aa07abe865d7d7cb85

SHA256
3503564a367d54ae73b8531755b7be2557769bad77a42d6cac0027051030e4f5

SHA512
c5fe1c260327025419cfbb7678b8d0a8d1eb48378bf24d83e4e9a1ba2b0208d059ee7ebac69f5c9659f36e3f9f17c9236bc158e1a5611e641c5c36fc6554e0e5

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabA69D.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarA963.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit