fe38e55a016ad65f0ced8ee129ccf504963372340747092aac170f5abb2a75c0

Analysis

max time kernel
136s
max time network
119s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
22/05/2024, 12:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6732000b42a41dbd7d75ec807ace8bda_JaffaCakes118.html
Size

158KB
MD5

6732000b42a41dbd7d75ec807ace8bda
SHA1

b94a688a2761643fbe4ade684649c90337963b9e
SHA256

fe38e55a016ad65f0ced8ee129ccf504963372340747092aac170f5abb2a75c0
SHA512

87bf9bea32d86eed95c61a183467cd7b983feb9d6ba90cc2ff4b42179061f18e2ac487a9a0913e12e303033a3d9c7b989d5858337af67b34e67cdada30afb3c2
SSDEEP

3072:Srt0m4NnU9E6RyfkMY+BES09JXAnyrZalI+YQ:SrtBMUG6UsMYod+X3oI+YQ

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 41 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bd2a7708e9798e4fa0b20f3efd8e93610000000002000000000010660000000100002000000085251c47230b8b38c430a71b2f7937b71bc74f72c749e568fee739a8e22098bc000000000e8000000002000020000000c7c08cefbdeab9245178b9fda20cb687298c783d1857caedb6a827c46a62609f9000000052dbcd5849d57a0b12acfe9f1e67068a6c90ad5ad15eaa9cf50103ab6bcae07eea2a38d5eab4db3918484a512528bdd9184e3f0a0243c06d2e87c6df491ffc96b07abe0f38ffa4da4e5289c8e14d2cc8d16029708a346515d2f209d3247d910d1a76db4aac93dfe58bf1f29df6950bb1634f8e6892b24c5feceec02e8d27c51bf50b5067465ab9fb7ba96c07971c6f2240000000f9da2102fa50f6648fa04072b0f02972ba381463ad12c102a83fad468842b66c2f5e31a445062c00b94ab89b5b026f85455ca4ebdc8172d5c0bf93917e8d8763	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bd2a7708e9798e4fa0b20f3efd8e93610000000002000000000010660000000100002000000026603d2cb16ca3587c72342604c4f1d1363ae06996343daf88e852b90f048da6000000000e8000000002000020000000b63f016a5c100893d8c006f38d7471ba836fb38027aebff113ee6a2b315b3fcf20000000b2c3bb63f9c7059fac446bad429c83ab1002620e297d9905db6b28db3df8f57f400000008535292a320bcd0987b5769b437761a2d92aff5a8c4f6d27c414cdc23611ff82d5fb07d5ce0e744109ead5b4ac42f98965caeab6cd6747f22177043428851c77	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = f0bc641140acda01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{FD8B77F1-1832-11EF-ADEA-C2931B856BB4} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422541144"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1680	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1680	iexplore.exe
1680	iexplore.exe
2900	IEXPLORE.EXE
2900	IEXPLORE.EXE
2900	IEXPLORE.EXE
2900	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1680 wrote to memory of 2900	1680	iexplore.exe	28
PID 1680 wrote to memory of 2900	1680	iexplore.exe	28
PID 1680 wrote to memory of 2900	1680	iexplore.exe	28
PID 1680 wrote to memory of 2900	1680	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\6732000b42a41dbd7d75ec807ace8bda_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1680
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1680 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2900

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ec46a64451fca16d9b8d7b67b1b756b0

SHA1
b402652bb1f2f9ef6233a25feaaf6eb9282c8ec1

SHA256
e49d7c27d7764fc9ecdf653cb2c1fe8fd4f434d032fe81541041b6522d3bb230

SHA512
d914a301ea6b02ec5be9589e90c5076700f9f2bb9378a6740f92c984af9461c8121ee449e7ee8e0fc33f3d5ba98af58377ae5888f0b5c106ff67f2ae351db52b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
37efa17d81a5b7660e4c02100affb0b8

SHA1
5c53999780c2673ace334a53d7ba115fdbb218ee

SHA256
914baf9732bc64f457ba9e55bd92e5cf48b0865653bcd771e2b30ff09f9d5512

SHA512
dc8d660d69e69f6ca62f84a0e6c5d35b5e1341ec1ee13cda129fc98af4a02d56ce3c9a0c8985cbe5382e7a022020cad75cf630621128dd261b338d886b26fb2d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3ad37c9c0262874c865b939d065466b2

SHA1
065020b987d6e0d62a889261ca24998db03cda69

SHA256
a8be7fdc059847b2e3bca71ad0205b3d4aea598ed4a46cd8c4c7928ea7d2e6e0

SHA512
a873d34796ae7b107d97d61edf013dc01c54c093ce54632a33caabfc0fb25eec349ec247f99e8dbd790c45bee179319d6f8f925bc18106836ad10edb41413789

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
93b97a76caad76d21a5f4167cb32ab97

SHA1
ef5f4d889d760c6db70c1e3d01d64ee1ed18ae40

SHA256
b8a62ced12d23bd5480e1e02f333bb6f7d4b1553ec9d88bf663a3388ec5984bb

SHA512
089e0c2ed629d8d021366514edca8414337b3385d1951c1713d412893d3e7049f0db4e080b77e75994ad5fa71d9eadd281e47a7c7d4789606be40c1497235674

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
67daa07ce1a397dedb546e112583e5c7

SHA1
47e3a68fd3211d1b1c7f3ea921f6d0d2178430bb

SHA256
8e42915297beae23018d7a6b5d01e749ea7bbf046264acc168820b196197be7b

SHA512
2b17ce517a04d9e7669a708e12bb854cead84791ca012efed8dc7c4eb89c0f7aec15e01ed3d2d038a8b8c98f40ea3e0942d6dea591852be43cc5fbe274b19ebf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e3e8771df56a7b22609dfd2cac48c048

SHA1
f802d7a15ce3167a493d876fc22ce0b4e5b580e0

SHA256
a034d7adca5a8ce9b5b4de28f706a912b4785dbd6ae2a50375f25216feb83e95

SHA512
47a15b8489333e9c1c11813d46ef489de5f7bf90b33be65e558928b43fb8610064fa7a9f3ce5c4dbf12110a593585027347a55f14767b8ccab5a0bba25170adc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
28f256816afbfdd11a2b8e5a76590044

SHA1
afd9be25c7fd84a6f46dd1bf6594f4968f6f7173

SHA256
90774a76ad842bc2c2034b56ad104f78fb7e1ae6523fa152c0bc9a2b465709c8

SHA512
99246a23b3c3662df8ff2855ce80be10a9e8ede55cfaf8bfed5a5731dd67c0a05a498871fbd4921139cc92139842c96871984fc0503a2291ae85c9ef57194278

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
25e910798764a379c204afe87f7108e0

SHA1
c455bf6f45143478a3b8f819b274ced3d4e02db5

SHA256
9ded12452cf73567ec86adbc24d2bb0714634e96952bc8817367e0b381dfa3a0

SHA512
2bc254b5743d64e044297312bbf4bfe1774336cba5554a78ccb939313379ed74e23a2911d976a2503b5b4839ef59700a2e58b4463afba81da37abef59b19db55

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
af0cd70cbf8d3391ab87112fd4d2f87d

SHA1
cc4ba3f1967bc6c10875ff8574d0c0218d9abf03

SHA256
a17f7a275c419e3d4743c5f192d1d996c34dddd2a5948157bf804081b1194e46

SHA512
0d5d8e142b5ce8a70b5ceb15b5db0bcb26453b82bb90301dd4ec00a024e549f04b0cadd91a2817dafbb522a5e89dee4d18d34a168fd515b1434e5baf57b91c25

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a38ad7f23229bafb4c27e6509f7af43e

SHA1
5f313aaf0e06baea23ca1f9a762e1923e2886214

SHA256
c65523a6abb41dceb2eb5efd7aea0f3a14993d77fff1260b3f66b0f5ac0e87e4

SHA512
1bc618a6229268740067f55348ea0cae72cb424ac54c63cf0dbb7f4150ac773d9f99ba8e50239126b34d82349051f12cab3f0763348631de72ff4d74ae2a2c57

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a37f12e82433309dd40cf4d7fd3694d2

SHA1
37999ecf4b986b4c060552ce89c35f981b409412

SHA256
e986584ceb7ead667e6858b8148402b0595f14e18cb3ade1af9532332d7e577d

SHA512
1d7446b63af3fa28951bd8eb9cb7c128a91106813e6324bf1fcdfdcd494af6f96df419e33428514e3ad2e88be86616ca3cde10f89a2a6aa4ff7ab5b12bbc8ed4

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab1509.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar1589.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit