d4c75140e495bf8192875363919c5c417954a4ef39d9f4f9a5ff3a167c1a4507

Analysis

max time kernel
119s
max time network
127s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
15/06/2024, 17:38

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

af97b65c6a461d6a2ee18864ceb21965_JaffaCakes118.html
Size

4KB
MD5

af97b65c6a461d6a2ee18864ceb21965
SHA1

f9d69b7c2d5036d81dda4cfb1ca2e55470e0c065
SHA256

d4c75140e495bf8192875363919c5c417954a4ef39d9f4f9a5ff3a167c1a4507
SHA512

aa41a5769813bfb050da9ba556e9126dc66a24b3cef6fa7d7f0fa351d9d4e2f9ec6ee08c7e44bef7c2aff4aeb563cd58c76edbb87a5ec577992bce5574ccc14b
SSDEEP

96:Pk7yJozTGknaEFHVKDZTBJl7sNjtXATIQFMA5e3fhrvDJUgwa71D5iJ8oseOUPEj:Pk7yY1aEFHVKtF37sNjtXATIQFM93pDP

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "424634971"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{1052DF41-2B3E-11EF-A550-7E1039193522} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000000b2968c6cf60b74b94229c882944fb810000000002000000000010660000000100002000000001cbb24d96c8791b19f6eed6d1efdd65a034fff63dab8e4b96bb2cb3fd055862000000000e800000000200002000000028538059b6dddae8cf146790e7a22d1fd4cfe2564df66564f4781389713e51fc90000000c49eecc597dda58b884f3816a4591c0e7983666da03ddeef8e3de431241b15c2ebb353455ea38e32d8b29c062c718f99835044b6af3a5dba5db6e4b5c60d2ebcc4ba18dcc5393da61cfb301be869d7424ae1732f9ab559990b24e6acaabea4898c624f6256de5cdf6febd20ca21ac7ce2eb0fa413898469a38dabcc4fb88d490b50443ce0b36898d685f0bd1d46069db40000000e03fbbeecd5246438091cc5ff77f66e7822e138e534ddddce181a4495d8a38cb5431b46d37a128e254d1251e04a5468ed28c38c541bdbab6e9217731e9fa0ef7	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000000b2968c6cf60b74b94229c882944fb810000000002000000000010660000000100002000000028c22bc652cb1bc55a1a77a7243da03de18cf77b0d8d2661c4b002b2c800e816000000000e8000000002000020000000221600062f8b58247aa90f333d0f19edb0c27a9425d99a4db47e7394313e93e2200000007b5816a824b50229f68e39de5d68fa7264af2ca1b4e142be3701bf706091ea2940000000195629e7d875ec069be354572be10bbc84ee112b8dd0b14e784ae1fbc6c2f9d75c0771c42c0afa7ddf206fb0292e6f871179cec0d9ceab3cb46cf04447a4c9ec	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = c013d4e44abfda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2204	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2204	iexplore.exe
2204	iexplore.exe
2276	IEXPLORE.EXE
2276	IEXPLORE.EXE
2276	IEXPLORE.EXE
2276	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2204 wrote to memory of 2276	2204	iexplore.exe	28
PID 2204 wrote to memory of 2276	2204	iexplore.exe	28
PID 2204 wrote to memory of 2276	2204	iexplore.exe	28
PID 2204 wrote to memory of 2276	2204	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\af97b65c6a461d6a2ee18864ceb21965_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2204
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2204 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2276

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b9cb4edb6e2b90660e1ceab38f3e0480

SHA1
e499f1e9456dcf84f99c89af33dbf28194ec5765

SHA256
60a83198a1b64a8d8ec0f9312aab20f70dccb7888a48bb5afad64bf99d20e262

SHA512
3c8b286b0b565ba4cf828e5d376f2cf98001ff47f79c38805769c549ef15bd18939e1dda936e3943ef846e354b1a035ba504935e09ca0fd3a90c5389b51aa67d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
57c707c312509b40837b2eebe8b07b77

SHA1
2b18b7d498cd50438a77436f93962e100aa0b48f

SHA256
2e8a044f7889a9039d62f23c2f7f1babc38258272c3a6357bf5ff4dc1dc732f3

SHA512
2ebc6e5e511a166e83453ae41a1646d28512047f199827485a699db846c5f078448a9e7cc8683dad629e47f578da979058fe734400a21bb200a07ab03575241a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5df7b1b8690ef8b3e1a3a39f24a6efd3

SHA1
c20468d8fe0d0dbf92d848e9be19c542bfac9614

SHA256
83244d2854d21210956a993caf114d5fe44199fcb24d90f41b9b1d3608c948d9

SHA512
b21e5f414928a26a66e80f9004ad5b8a11df50e29b6ee81e5778bd6331d04afff8bdf0c394ad40b9d6f792206f42e709111fe231df7f3e33b18b0844f2491784

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4ada7858dc8c83ec3c42f50f5287e829

SHA1
49a43fea0a50a9dba3d3f9336db63b3f1510807a

SHA256
a7e01905e42bfd2f16cc6afbe48b3f7e28eaceb18e07f4f6b3e8231f1902406d

SHA512
e312b17f099e19cf820b5a69a138f727cf3bb7d73f55499553235b7cb2cb027f88a1f1532f85dea26ee9091c046112b55c996d7f77cb01535a7ddcbe90365ac5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
48a4f9cccb651c0fb03797a770353e1b

SHA1
5de74c12172906c98ac44c9a40597e76f25d58c5

SHA256
857e1f4afe1a8cad8be7376acfaa0b88f24047a48a199d9295f5337e8811e1fc

SHA512
41134c84539083343bf708e5f182599706938b546d734f6d32fe78e910315e2342de510221df6e69a2e0bc01e3355509bae73634ab4b0f2ae1fd159bb1d678ff

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
aa3ca94a2d213c1e5ff30aedf54e07e0

SHA1
a8c241d6c09c74325587e5acdedb963b283e7566

SHA256
7ebb5cd3d889df5abce65b2f5a1c40e3672d17914ecd1669772d0d51cd8b7d65

SHA512
5ae8fe2240a6dab7ae40a982794284e326d354a7ce8934e8570e121ea03ec3a7b0dc2649354e6e999ea99d50cf7c3e93bb5fcfa5f0cac2a83ff5d12928560e55

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
49abcbb944e21389350c6ad28af732f3

SHA1
97e88106d9e3accb57af5530694c93b3cdc11dae

SHA256
b2759a7228b503c0cea45f9401e4f8b74c2489b92345bb715c24ea5dbb8ac3f4

SHA512
5ca270840f60bbbf838a690f8428b42fc8b50b7fa60c3df8ad20cb2358576f3f652100347f0af6e2c4eaf29c6859693f3392be545448505a027fb5f0c869297f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
687c078b59bb25ccd17570292f71f58e

SHA1
1b993771d9179f8b6cbb05fc0d51fdcc7c0e5eb9

SHA256
bd39f61e8a2c40fcd2565d10b52b717ff7cf5163f085e2e62cd794ad2d3c12f5

SHA512
e09a728fa0cadb2ae657c3ecf797132599520c22eaada49e2a9986578a53ab108cde325362df1d204645511dc2fadefd8c800fc4cfc2fdd8515828e9e2090e6c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
633396508d8fd94ec02158bb2729baeb

SHA1
db36c3fc0902147736ca3fa8a13b319bbb25b36b

SHA256
d1d530e1ffe67fca9e4498b2fd806a401e0e3ef3dc54f96bec9309c604f65be3

SHA512
cfb32865b51b49fb98a0af13fc3daac884cb3c1e85745a7eb192928980101662d74c76a03cc0c64983e015799e6832f05a6847b2b290821b3bcd089a72161c91

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d2c7aac4a0629c88e234fa87b4ad8017

SHA1
c2a4144dbacc45a2674740620b7fb2ae39586017

SHA256
4c9b67ec213785a4642565299590103e0662904d9c799246ef1e899d7df9e380

SHA512
5f14b7043fb8115b1c9c20f86ef8c0c1e8762dac2a33b2ef9fcf076985f4ac84fdb9fe39ee1a98b697feb67b16b191abbaa71c0a63a76cf1c6484696fb5768ee

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4dfaa683be30939f55b991979444e15f

SHA1
d7aee6a009376425397fe42df6da1409115d2029

SHA256
34f34d0820c5c7c78a57c8f67467cb23f35673795e3ab8d487fe0810ec0c3525

SHA512
764f935f3737a32767c742e697db87099420e76378aac6cb96a3758483397dfa9f6f2e8d6b986edfa851100f31a4263d78ab8b20545475cf599c9c4cf861e123

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0946cdaba7ccf33b23afa628aa211854

SHA1
0da4d596a62fa67efbee99ae1c53f91051042498

SHA256
2a94523a0553ecdc0269ffef1f58d5ce989ed792515d47b42e91c759da16c8d5

SHA512
8569236989d39d6479f003dfdcd24bbfb20855c90f97d07c8a545ef8f307ac3707bda0edde8e43589637d33f1927d98b72166862a159040862350b0359914246

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c28b02964d170d60cd8e7f668eb26e0d

SHA1
a6ee582154dbb4acf550f3a704adb5952b103496

SHA256
37633ffdc507fb58a55eef4460cf9b4e6bab6fb40caaef7917cb210d20d5a40a

SHA512
c1cff52f244d13d8ba79c0c821a3505931c370b94780a9de2c1a8bc942e47c5a06e1955c43765e673f5d151fef94fbe12b2e8f77b7f32556b987d84bebc6447a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a859818ba62bdaec5933b3d7a1d51afe

SHA1
e2b678dbadf19f5b514bdcfd209a0a0efcb3dafe

SHA256
13bc56f08608171e40fb4df96e1ed4bb513c6e32f0aa7ccf85ed035d49e41904

SHA512
4929bfe3a5622fb696cca82ac01327a8937faa4be09eae3ecfa740410eb3d1148cfae12b248dc72f7b2fb62c2843e401c406c9708bb62b67e2cee1b7aa2786cd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
18e6841db5e52fa1954225a4d0b1cee4

SHA1
9ad975b275e59e43e89b8d7829caacc38847060b

SHA256
cc4ada1efc4c1f845f73743fe7a0ecc51be16fab88276d9ba1d554968b5a4692

SHA512
ea3e066d3e4115bcb7de7942c73f1b1554b11c5ece7fc591f01ec915792448e4e17c8cd055e878c7c4066525c40b19e50b669381548d4a25d07d05bd27241adb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a15c32cdb1322fb05b38d282ac8cf985

SHA1
d5056088d08f83311952d86ad655485b25d38547

SHA256
7c7333257198876bd16b9f3203fcbbfcfb20629e1e41d068b85015498c74f67b

SHA512
ccee9dc75bf0c4266baf4aea917b20f9a493a3414f38091aeca38bdb563400af9c6ded6f8532c8ca41d48d67e47646550f2cdb55f6f0021e67c82543fd460347

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab2752.tmp

Filesize
67KB

MD5
2d3dcf90f6c99f47e7593ea250c9e749

SHA1
51be82be4a272669983313565b4940d4b1385237

SHA256
8714e7be9f9b6de26673d9d09bd4c9f41b1b27ae10b1d56a7ad83abd7430ebd4

SHA512
9c11dd7d448ffebe2167acde37be77d42175edacf5aaf6fb31d3bdfe6bb1f63f5fdbc9a0a2125ed9d5ce0529b6b548818c8021532e1ea6b324717cc9bec0aaa5

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar27A7.tmp

Filesize
160KB

MD5
7186ad693b8ad9444401bd9bcd2217c2

SHA1
5c28ca10a650f6026b0df4737078fa4197f3bac1

SHA256
9a71fa0cb44aa51412b16a0bf83a275977ba4e807d022f78364338b99b3a3eed

SHA512
135be0e6370fd057762c56149526f46bf6a62fb65ef5b3b26ae01fa07b4c4e37188e203bd3812f31e260ec5cccff5924633dd55ab17e9fa106479783c2fb212b

Download Submit