497fec0f1c9bddc3ab1868860214de337a9354b0600b6d6b611d20c1f46622cb

Analysis

max time kernel
134s
max time network
127s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
12/06/2024, 15:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a13381856954f05ab5c865fed1247150_JaffaCakes118.html
Size

67KB
MD5

a13381856954f05ab5c865fed1247150
SHA1

cfbdb840b3d5f0ff46133c209bdbf78d5a9d6c7a
SHA256

497fec0f1c9bddc3ab1868860214de337a9354b0600b6d6b611d20c1f46622cb
SHA512

ee98aa25003a7b39bf0c19371b06c9ed15eda51bb7990865f4821156bd1942ecd290b1915c783c13bce63ee9b8627118102e9249fbbfc4154c6e018ce02e46c6
SSDEEP

768:JiKgcMsSZ8tN99OIsRpsMb4MoTySqQCZkoTnMdtbBnfBgN8/oygcR/QFVG8c//IK:JIWtTYPec0tbrga6cuNnzIjv

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000006fb3d087c4ee9c4bb22550fd83a0390500000000020000000000106600000001000020000000e7f08ac5cb44e87e31c5308edca7424def9f65f97f21bbac022727590273aeaf000000000e80000000020000200000009efaf1ee5a5899a0e097b218df6ae2ba3d03e982170e5b92a828ef888441c21020000000dd2bc440d2205c59cb64ad6fbce7664216e2cf9711bbc7a4e3abb75c48c7b480400000007a6049eb92d5fa0d09966d9ec6fdcfd8262c9f7a7a24f908bff32cf53da3c72901767694584fac332122c5e7f77f5bb7f5a1a6cb15525c5c62403a4e36f561d6	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{AF71E171-28D2-11EF-A0E1-D2ACEE0A983D} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000006fb3d087c4ee9c4bb22550fd83a0390500000000020000000000106600000001000020000000c38b170d7113e159eed4257f0b786b76e2ae351e77948cf4d952b32d3137aa24000000000e800000000200002000000040b24cd5a34903632156acaf6ffa210e00e256ddf902a9281719937e608f5a89900000003500f7b97cfceaf02c7e05d013c06acd9c5929a376fb17b400e194a2ee01d61681c1d1d0177aeecec0d39c2d58a4a6d4acdf13dc70347f436b70602fce6602fb34f090d3bada3827ecc7d34d5ecfd2b647ae1bc8c66000aaa37858b7482663ba64cf508536287fca6b81377a9d8a80b9469110aa94c4b87beee96471aeb6eff31449d47693702f3f9fe6a86d6082e30f40000000102842be61c65a865f56e8deb038a0cacaa40f407b64447747a8a484d7b02da715569189b46e5f1ae6c5cd78d9f6b7b86c68156042a92b25b6eade3886c0d768	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "424368950"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = a0df9684dfbcda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2484	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2484	iexplore.exe
2484	iexplore.exe
2432	IEXPLORE.EXE
2432	IEXPLORE.EXE
2432	IEXPLORE.EXE
2432	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2484 wrote to memory of 2432	2484	iexplore.exe	28
PID 2484 wrote to memory of 2432	2484	iexplore.exe	28
PID 2484 wrote to memory of 2432	2484	iexplore.exe	28
PID 2484 wrote to memory of 2432	2484	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\a13381856954f05ab5c865fed1247150_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2484
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2484 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2432

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

Filesize
1KB

MD5
660b6e28b38ebe7e521064e60113fffc

SHA1
f2c25e9f931876bf6834191ec5b409f47f869129

SHA256
3e203426c4aa1403e940966905320c612ce4006cc87e03eb64058eaf6d402433

SHA512
96868e652d5e0c25b4d0f0ada20d345115f0c6fda26d3cab724c0c1867386d2dcedc408c51f776b7e019ce2e22755017d99bf663cdd9fd0d88b26182c6434bcc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA

Filesize
724B

MD5
ac89a852c2aaa3d389b2d2dd312ad367

SHA1
8f421dd6493c61dbda6b839e2debb7b50a20c930

SHA256
0b720e19270c672f9b6e0ec40b468ac49376807de08a814573fe038779534f45

SHA512
c6a88f33688cc0c287f04005e07d5b5e4a8721d204aa429f93ade2a56aeb86e05d89a8f7a44c1e93359a185a4c5f418240c6cdbc5a21314226681c744cf37f36

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d7047da7c904ae206d6b99ac51c76e9e

SHA1
6e2dbdfccef585493bbfd948478866aa9a7f1eaa

SHA256
62ca92b4fe392afe1700d6c37c1b414b3e96cd4ac1eb33c0a5ea2a296ab6f372

SHA512
4439b4e3e44f0bd32edca50c3438ab0828ed01a82abc914bf0b4052d3623e4a422b84adf6e3aa49103ee27acb3c2959e499dabd030ff8f6a5c6bc2511e256964

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2729817e2242f8454f3a700817970d33

SHA1
8d37517b872a92b457c30efdd039ce2bd1a78c65

SHA256
832b78944249e65ce2b8700577fa223d33052fa50340cf2a1e7deacb7d464839

SHA512
49b0a44e2ff43b1e39f37d45478b0578e3d9b3c79716fbee20269d1b24697c279ab385e55764652f3a92cd0d75aa00ab2ee513223491327b53e2404141300219

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6afa658266dc2b1310e475ac5b8a3a94

SHA1
056a44ad3ebeaa53fe71b71f5e9e5e3fb3341fc3

SHA256
ff36453dbd8aee161a200ea86b36f62ad5ba1f3fcb355b0450c37a9e8768592d

SHA512
fa144f3acd24a514c7f0c6617bd97e11347ebdc33999c54065f77bae8064be515bef93ec61cfc79867224b6279c297bc510112a18b0af380ea9d6a03f84071c1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a07ab7e1861bee208b4383041c5b71c5

SHA1
9e802407bed019914c529ceff2da139b23e6a00d

SHA256
82b5de5236e67c0d3de3a03b46fe73c9fbd4aa89d23c033c55705d4c031d8796

SHA512
43885bacfde3fb2e0f5e7345ed104b15e76b6dc836741de9fb1ba6193525be5ba7646b8b0afa45d8175b39a44ce6bbc2dce0ef2740e51e30e7dbd5809216e909

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b01a4c2df1077a7a9a5fa5266e76d0cc

SHA1
8441ac1824603b9afcd293caacb16215871e9fc1

SHA256
6ba7f5bbb0a0d13d84dc81514d129e9c33bbf353492480c8382f91cad081b670

SHA512
09866f43738c7a93f0681fe65877b6bdaaebd43e98df93941b9fce7a3cc79d398e664014a80a63aa60d86374a942b6c7ada148c09a2ec3ecab0289c3ff767af8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
bd2d8145275188380b2dea620e5fac03

SHA1
1d1c30ce2b7bb881857e95b3b58af7c793122091

SHA256
c78f2a82815e4913b4e2cf504b3fbe7dfffa35da62a6487dbdd92cf02635005a

SHA512
3f3ec721e6580d738e841a52cd031e7bf8f470b08fa1d8ad47dc5ac299b86a36081a1c3b0cf7523484a67838605599ccc4d6201cf8e427c96da094eb1e8646c8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
800ba8d79ca34239f555487746e5ec34

SHA1
153c6996688fc16383ab1c767d2c0dd483049178

SHA256
a1928edf4bdb10d69a3d80d8cff3fbe2c73203868016b892f35e93b8f133cef3

SHA512
92c00bf559899f46ce1b906d9dd355e5e60335639bd2505e1a48af48b83dd3e8bf3ef9dfec620bb7928de905e8a153eec744cbb2cf9b746aae9813073a5a9712

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5901e1a6337c3686cb79c2e08155b150

SHA1
545b6ef6a110735f13f373ab309cb12ef43af2f7

SHA256
20c4468c570f00e4211a34032d6f398bee5eec7340a9d3caf46fd4eb908438be

SHA512
63e1311433cac426371c79f8b579d1d42b30bcc541b05cc35b941f6821100dc3033e837176ba2ed01dbe2b39fccf83e3350e673d52a79724876fcd1079e0011d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ced63056e768f78acbcd28cebb90996b

SHA1
84b2e41e236523601677d51d70a8e622c089732e

SHA256
9a4a28dc5fd22ca66595563e5198530511121c2b3fd865c5f5a1342f3a69b02b

SHA512
002cf5f04866c5566b63d6d3f0fdc3ee9fb12dba2dcfc674e3e10a9272c7b600f6a3332e6fa75cc79c10b14d42e374d05c53f26783fdf7ebbd013856ccb5b024

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9ecd718d9f7ec2274d347ec0d1e64761

SHA1
cb892cbf5571555744939e428e11d32b7f2b8462

SHA256
7999d1960c532405a96c5312dc0242af69ce30f8e1aa2435dc1b259a4099b179

SHA512
805238dea4ab64bddd64af29809eae72f9ed59691bfb31d7f27dc3c236115e27612a807c3c06613a173753f0d822e9329097619db615641725305ce90c89cdea

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
18ea4886768a014d48c29cb09dd0730e

SHA1
b3670e34b354e984974740ceaa59e030793ae183

SHA256
33ecd9705402b97a466296d1c60ef3221ba72f592c005283b4845fdc60d940e3

SHA512
f9f18eb81e8c982893e3fc94f8bbe37e57d6f2608bd2d1e36f1029a640ac5400b957d890eaf8e79c89314863044ff010b01df656d62af80a0c429e72f4fe2584

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7c7402bf2350cc4c929d65d8f85ebd17

SHA1
ee3ce8de90ab5a428353819c74ae5f37f2e2c76a

SHA256
99958d3d865e4fc86288f69e3bb3609d19880ca0b8a59c9a28d32716ef3c2f30

SHA512
3ad5f33a73e6b415d01de229f8c8b8d5825066523e00594858eba48bf48bf9ebf7b3c54b5662ce5e095b3d02812cb24f5e5ceea3c0e7bee4c6507108b9a1143d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab26E4.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar26E6.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit