11eebfd891a294780b07d56d733b87e0dc9938e6ee5264cf01c81ffcd23281ea

Analysis

max time kernel
137s
max time network
140s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
27/05/2024, 17:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

79f9090ac734c4102d7f03de7cfb2186_JaffaCakes118.html
Size

15KB
MD5

79f9090ac734c4102d7f03de7cfb2186
SHA1

792e14390ccda29eac9b9a841643747f21d56a26
SHA256

11eebfd891a294780b07d56d733b87e0dc9938e6ee5264cf01c81ffcd23281ea
SHA512

bf4db65ad48a1e6b584b5d123aaeff50230da93cecf65ccc6d1ea0adf83ac2c31e5aa742d9a0a8c864b4daf69fec16e72116d9ded8e5b9be9c6c5fd01a043910
SSDEEP

384:HmX6Bl2ihokt9Szold/jIBXDRWPBMUwdwV2/p6I7Tvn3/oWRB5:Uuz6kt9SElVjIUCT//p6OoWRB5

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000587104b0d2f7da409208cf3ae9e77a2300000000020000000000106600000001000020000000e8c61d2cb1d76cc001e120325b4358f7120ccb07bce6d44facc27db20d213447000000000e80000000020000200000004fd7e54ea53f6aa331aa6c20280f52291868d2589be7176a19e54ca4d6c4cb612000000003a20291acd6f4af008584c515b1c5ab2db0085fc6504202fca830a53b97d8aa40000000980e1b82dfb4f783438d3bf47d9f1f4d06dfc572150c11579a8286d08eed38aab695650321800dfa503e73bec7201d795bc2c00c838b9e9edc76a46fbdd2817b	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000587104b0d2f7da409208cf3ae9e77a2300000000020000000000106600000001000020000000f5073937e55233e7e8727b98fc73a984bbc7ed5441bc94780dad3b9496f8b00a000000000e80000000020000200000001144c9a16cc05d86bcba44649430e4c7d11fa102104c002c7a53c421334beac490000000a07bebc25bc9d432e17c26da4fda5c015312779c7797f406562d4a2eb541f3c2acbecda554d522731fb4cc9ff2317f93b9cf2f1aae965565763eef21b3e3b32db84c90cf33994fa25f4fe3e4d07255e472e78692af92667f0a055dcb71b9e7a7207c26527516ec02b680ed0dcd4c9dafcf84a7b6ba7cb58ea5d48e170d9ca4424c61d86a3c2d19e1b665832d439ee3bd400000004a9943a5e71e18fc3a07982fda9985f1040688a5182a9ad69405fd672646791b49b953ccb951db4870d7021b56adfc694d5073132a621a8d84df4c4c36be6647	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422993941"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{3ECE7831-1C51-11EF-BF51-4E559C6B32B6} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 005c46315eb0da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2992	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2992	iexplore.exe
2992	iexplore.exe
2916	IEXPLORE.EXE
2916	IEXPLORE.EXE
2916	IEXPLORE.EXE
2916	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2992 wrote to memory of 2916	2992	iexplore.exe	28
PID 2992 wrote to memory of 2916	2992	iexplore.exe	28
PID 2992 wrote to memory of 2916	2992	iexplore.exe	28
PID 2992 wrote to memory of 2916	2992	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\79f9090ac734c4102d7f03de7cfb2186_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2992
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2992 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2916

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0c0bae1ed40d59da7f0fa53447973bd4

SHA1
dc0e5621f08ad5fb5ce6722013acc3a71e21b366

SHA256
c3ce0b6ba7023fde378a82682174f2a6aae720219fc2426d94c0e02d5ee49caf

SHA512
34d99fd4bd1bdff4a5c2d8c078c0a92bf888b9b46b669eee19d2ce4f4a1ace0002cf3da1f580c87a51a679dde0e1c0823813cc0dbc76364e0f299e686000a5fc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f992f2d300f35ab8ee76e6aa1040f48c

SHA1
cd41698677049e2ca09a1f5e49c2d753c6586f36

SHA256
abe6b201a5beea941fe0e3766614f46bbeb8ee60853fbf1bd19cfeb4ef3fe065

SHA512
f2a344ad0ddd68a9fdafbc4fd3fc7bea8503b14e8f8c095e97a49b0a830a9392937919a8e873799c589635f0adc3d83b30482b93a6372097412143bc74fb4eee

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f17a5145a4d3d5db874f91536c0807c0

SHA1
7bc7a8691f4fb37ef320b309bd3c583b75da12da

SHA256
73df67fb488e3f151565dd7abe1bb20bbc1f4519ea9e382ecd353f8180b394fa

SHA512
04d02cf3f5f7642d80568e743db66bb2f970b9e6db9f8e1aa1e4b6046c0e402c9110e3d2f917cab52aee8563668815af15987a47b643074f1aed39d1a86bc48d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
72feb7d4e77086bfc3d1335d7fa02f0a

SHA1
f1a6a0eb7615351baea3b1ddd069ed834a9e5f58

SHA256
d8537b36603913793839df24a5782df21ee115df043382f109e7968785abd256

SHA512
58c25e33ed848b6d8bc4949e92b7cd6b0b048cb13d5879588651923ce6d3d75cd4053656e537d8f42a175cae082000f11c9e0c56dbc2b2005259f277f2953acf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b461ba2c50c579d30a53789e0353856b

SHA1
76b397885b0ae9f50b96bc080359bd89913a5087

SHA256
a9861199762340698675927162f75829e5e3990227b18ff2afbaa77aff9f9d85

SHA512
77b21a8605722379486348f020db51896fb5139557709aaa3ac63510a8476dfb01ace31131cc7be4485b4b221c623fee309b2247df784b99e38eac916ce4d321

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4af6bb8a6c18808d2cf23d31f2539182

SHA1
61d30f3d78dd39f8c7619ed040b79e5463945ae3

SHA256
e1fe909dcf4310a1479d33b76b1b6fa151706a2987354e06e62947b29eab13cd

SHA512
9419bae2bb8b83116c5726fd837fe8a080ab8eeae9652ca54f98da0cd9b92441e6b6461bd94d16b2133e7095dcd10f18010b90409fb7ea9c493b84a2d84f7632

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8d73f3aef6590a2d04e099aecc4ef13f

SHA1
d82d1205dd4255e05e55d8dca006e556bf3bd825

SHA256
33140a7969d503aead7d6d41c0fcf2480cb7fe223af954b5e2f5cfd698cf2dbc

SHA512
9a2280580e17fb1f6d6b8b896e91b319c9bfa53dce1ef73419e80510822ab28c551d94c54be9c75a75f8827b28621d04bf37a152f8437b1956fcac05129b2db5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
263858be13f63804067b7b74601f207e

SHA1
d1ebbbfc74303d247aec026b0497cf8775a710de

SHA256
32258c93d4b899e6c3d99383bb0587a02a4ba4676e16514a727a70abff15eaaa

SHA512
03179b0d980fcb402e5b72f1d002b3d6701e121e7637149021b02f1cbb5df5483e36a92992d04c62920ec148db8404a3d2827479c9e2a952449ac7e276ab69a5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9e0a8ebed1b1109b09a8c515f9ed0df8

SHA1
73ee1a592d2ad91dc80a47adb686a2e8b233f085

SHA256
6ca793f38ee247eb1ceb6115754253296adca270b098e7f23ab1448ff181587b

SHA512
43212a4078f1312a5642a0bfd13e085a6eb9e2b2aca6f2cf00eaa874d9e96636452a04522aed50aaf03b813949004f1bc788a47ef74d997616cd5790dfad270c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9c49132b418bee9429dab1c003358915

SHA1
0cb921da2f132a46f9aa5a466fc00767d1d45593

SHA256
cc23560005e9a042c9c41ea1510b12c585ac894c0eb29705c35afdbbd9adf73b

SHA512
29b6e1917890efa90606ef875894dcb659b1f0f2a47f802fceaab82fa11f2fbfb98a646ef55489f32612256aff3ddedcbfb6ba1997e53920b3dedd4d6ea5a11b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
715c0dabc5dc134e8f43e77ac87e097c

SHA1
0a477131d72a03637ab2a392d48f10bdfdb9f45d

SHA256
f226097261e12e68530b0a6d7ca62a7b4c6b5e6c3dd5f65a20ee4429b93d1bc8

SHA512
7767333a8539d4ff1ab1c77fb848dfb114867f58b4c7327c9cd1c5036335e95c03ad45d6cbec16303b13d01f14a678f7c29c911d9e7cbd35769307a69db7a55c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1d1a793a07dcad3c331a80b92079d90b

SHA1
71588146af517293b9e4c0b317f49ce40c1f5fe1

SHA256
9bd9a3ac9034ac03b934d0ba1d3ac84937c96cb4db32e395d642ef4bacc0d839

SHA512
0fe138d8f2f181e060701a35d9518e8a205b1bbbe8979aaa9e56bbc0e8e7363342d52626db6df209268ab19ca364efc4ebe0e85f2b2a13ef54c5944859a80b71

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2b85be8453f6f1fa08f8dc4eac800706

SHA1
11a27f78ae20bfa932fb2c87e2d67630488a90ea

SHA256
890247f25b9ccd1fa0dbfd0ef0b08220d76c835f7abce34ef099a4b623019db2

SHA512
02064c6c771bc94281a59b40a2b933bb1db5733d419fe328b8d70999a4ddf74a86d39998d112cfe04b6fd7a29831f3ff36b1ef1247dbcea6927bab977b2c02a0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3c0d91e008b746b7bf71e6d3358e3c84

SHA1
01d74ac871ed375ea951ffc608ed3798a4b3173f

SHA256
fa8ff9d08a57c4c5dafbbb1ab86f41cf2d946b7890a3a7fd68619c1d233de635

SHA512
e664129acd5d1468230311302514d65f721feeef09c2f6995ddb5812c7010a4ac597c70e1a7c9f458553b583503611664d4ee9b6e6162c765db608787fbeb5b6

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabFCF8.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarFD58.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit