214e6a9b663fc8d1ff60099137c2439529253713e913909eedba7df2d96c95b7

Analysis

max time kernel
137s
max time network
138s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
28/05/2024, 14:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7d5e19fd8709dc0749a940e442a74cf7_JaffaCakes118.html
Size

4KB
MD5

7d5e19fd8709dc0749a940e442a74cf7
SHA1

1416e97a425e02b5e3272abfce684f66f1457557
SHA256

214e6a9b663fc8d1ff60099137c2439529253713e913909eedba7df2d96c95b7
SHA512

334173d5f17cd68fead34cb74de2ee4ced5b895224864c6ed6a32756e82714ac16845ec744f434a9b4ddb8379d7d9ed4a5aec8ba40ad9b7da69b309045b3a94d
SSDEEP

96:Pk7yJozTGknaEFHVKDZTBJl7sNjtXATIQFMA5e3fhrvDJUgwa71D5iJ8oFx4d:Pk7yY1aEFHVKtF37sNjtXATIQFM93pDb

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a5579806cd1c37438858c252de0913b7000000000200000000001066000000010000200000007619737f7d1165c0f3e5ca8d9792d80444f886ea1e8a34d856220a8633a016cc000000000e80000000020000200000005c0225a07463b06bc3afaa0f1fccc2cef6b731a91bfe85035b44c7be2e21c05d90000000090164870abc2f178b429fd2f31f24d6c6215f01c2486f3f53eef1fe9c102ced32f5e704f3bff76839005aa7ad5267e24d8236ea95004a5ceaf3cd9efbdcbfaf00e341e62213a133c7a1c3e596241297d29624f8cd192c987dedda9caa84e9f49f9c8fe4a25c1bf0366312a390b2071eabf05b5f62a5cc965f2426bdc9643b950a63c04d62dd4b95fe8be48d18ad565a400000006906d43c7175390c52b9a0870834974f9f7b99c87d8a1e3c63da1004ea6be35c5b2346e43dcf7f2ace0f0e644cdc26df3e051b89554235c04d2bae7704749206	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a5579806cd1c37438858c252de0913b700000000020000000000106600000001000020000000df0d1a6d6f856416e80f349d7975abe57c8b906317908574b2d8728f6e5c544d000000000e800000000200002000000068687fd1b780ea865444d31c31c190f355e7981d18ca0166735d6d84d33b58f5200000004baeb0b186e3e8e043a9e2e0b449e7e295377f684daeaa857aa4e642bcb0a2b9400000000835f826c04ee3f930ad27de5575e199278ee1e2d4cf409dea9ac0b9b5452f2c70926b10962bbf67597a7072e2a356d3b26d23f336e3c24fb9df19a1c29c9428	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{43093641-1D02-11EF-B411-768C8F534424} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 30999b170fb1da01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423069980"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3000	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
3000	iexplore.exe
3000	iexplore.exe
768	IEXPLORE.EXE
768	IEXPLORE.EXE
768	IEXPLORE.EXE
768	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3000 wrote to memory of 768	3000	iexplore.exe	28
PID 3000 wrote to memory of 768	3000	iexplore.exe	28
PID 3000 wrote to memory of 768	3000	iexplore.exe	28
PID 3000 wrote to memory of 768	3000	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\7d5e19fd8709dc0749a940e442a74cf7_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3000
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3000 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:768

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1edd8c712902f143cd21f3a3d500d86a

SHA1
46dd83a5a827b1dd86015eebad56faea74f8e6cc

SHA256
0b579e79881fa6c70a9df816b7bf1d3a6224f39a986ac4a3930256d9a4a74cb0

SHA512
85e5b5aa1024e7c3ea62091bd05455c01a8e6a384a5e78d6d9ccb248fea5adcbc0eaab54abc8a11066ad5d0aa62115c80bf6a18831cd113f5819978121083645

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5bd67f0cc9a60be626fcb080a592574a

SHA1
549c0cfa2210f8a2ae2997da6bbfc8b7d774c00e

SHA256
bf1854da219a5f3dce07c8925522f694bc904899f85aa5f2f11e3cdca4063ab8

SHA512
5f341ff20c378d63aba640e52307a63d423242603e6b8e1d12f2304d9d13ea1c178c8f4b41e2a2334c2886171c56b2f2c29b8be330a8871a5f482d73a29388f7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8df43b13e675c27a308b604978475eb4

SHA1
365c59b9281dab75e66b8bbbaa2c578fc1e2d046

SHA256
4eefbece702597b432dd17a66b206f4096559dbdbaafb106869c9553e4af13d0

SHA512
ea7aad715a42770905307c33f059a7e2f19c13e7624efb2925ac084184e627bfc4e51a4bec63c30a7e88fd286361d8abccb56acbf5c722cd3323bfd5b3004aee

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
003f0aa7a7ffdf68cb50a6d7b8dbbd6c

SHA1
1d9ed5ec20a76a17292f256bbf9675c75e31ebdf

SHA256
321cec56e9db9094b4e23be5bf1d7e773ffa4f88dc80039eeb47977794adc0a4

SHA512
4159274a7d264a109ae11d5c218f42f61a58ed794791fc6320cf84e0f4be2691c2ebb87f80b94e492d7b4a40ec6d5ee50637bb74611964167d0798c8e2441d4e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
61ca7ef0ed1d4b75942d70b11db6acf1

SHA1
beb8380dfdb29000d3fd3984d0e6677031588297

SHA256
e387b4a5fafcfbb6cb0e130d8bc9f808c4bbafe6dd6d4e2be6d5a013d77eabf4

SHA512
f8a755989a7b8480e276cb8e7630cce499d1cd238f79f8e200a6de3cf951f650b56f2bfba93872c91604a838587b385ff12f30e6e34c4f67b48b9e33addebe77

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cf304c5d48221ac1568051d10e9b338d

SHA1
7879749d38d2aa35fd131f70327303ea9e1a5f2c

SHA256
c470b961bd6e50bcf52ffa59bdfeeefbf76411752ac5aa8d73e4b547c5390a1d

SHA512
eb0d7d14f6ba8d4d852a9ae4fc2d3c411d62c87d3516e4f7b840fc1f39170d5bb39719922acc0b162d8fb267245b29e282daee55f47861199011ec523a3bc3bb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
06d5f50a8b3f2073189a27644a49195b

SHA1
46c719fc6b29131ffe631b6aace1c63a97a70981

SHA256
c52867d6397d1f11eaa730d05aeff5e26cba1feb2ae503f3eeaa225c8b77b75d

SHA512
f113eae663ef2e9b690cdb71d973d508dd3c715fb76b284919d3064da0426abda9f745ce63d820e5021c3b9945467f84e313c1a0fe4e3cb843f80e3836117cba

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e51d10fbbc741179256efcad4510184d

SHA1
15b3ca6e4d52ffa9781871fa800d82a777272b7a

SHA256
83aacba8723dcb3ae2b8e2892a3c37cc6b3eb3a8cd8028612b46d7ad872e6ad6

SHA512
db5ee611025be07257bcfdcfbc8f164abbaf15aba7bd5a2b1324e4e06b0424521260583d6bb88968485095126234d1f2e8208a99a37237e34c5999d750f4b5d7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ca35cf5f2167b62af24d2bf12a51fec5

SHA1
8ee359428152bd80cf18f08fd6871512c392b588

SHA256
eff80c623a09c34d680ccc0b08fc2317ac46270fa79ebbd3bbda17f002f3d94f

SHA512
59428dc5061b96543b459cd4b559d1c504d82e4198833157b7c09b09199f4b0554ce38addf155873798fdc4eff1aa5f5ef10d0e481174385e3398f89c27d9ef6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
667051eae2ecc1fa0f07febda5e74e79

SHA1
77fc0e959da0b8467c5a8cbaf68025f03b8765ab

SHA256
7eeb9c2b8c8a0742a68f47035ac056d4d30f69d62536b90696c4814101995723

SHA512
a1795e39d60d8282726a5d46a644509448e4a9812df4930a6a405975bff3c7cbb4846a5066c569303a13b685db8dff78eae7ea7388d2d95b82bb7c371add1a84

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
af5df33ba5c7bf13b12f72a182c4c219

SHA1
0e0a539b5e13d88d1d7772ab60ebf6999b921749

SHA256
84a27d6af50676809667218ba46c7a43e7d92623dc1678542a4038ed097bc953

SHA512
993f29c13c5d49c86d2487d7b78dd32bc9f57c7087f0f20d60fcf0bbc904f087aa2109c1649d34adb28527ed586ef3187ea56c13a087c4a8ec63a59fd3893f35

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b3f1144d0ce4df15fd3fd8264572def2

SHA1
062d68b8bcfa3a604c72bb83d86d4c98bc8c1a12

SHA256
15be469cfba05c491963f405edd2e4e825070b0e932b949da4c11240da2fba5c

SHA512
d8bf6b3926d7c5c993c75e603d6a7dc1b15495e79552c667db896b6e16ba493aad70d2eab17984edabb9c312641764de562679720b8fcfae85a75cf24c84de1a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab31DB.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar3379.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit