e7e67c9d260d7dad8efa8273afe8ba93a0627703d647f5d173ac9027ba4221df

Analysis

max time kernel
119s
max time network
136s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
16/06/2024, 01:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b12a5ce4d673146e9dea7926d3307763_JaffaCakes118.html
Size

38KB
MD5

b12a5ce4d673146e9dea7926d3307763
SHA1

e104d7c79745e0bd431f40223bc77be220258e0b
SHA256

e7e67c9d260d7dad8efa8273afe8ba93a0627703d647f5d173ac9027ba4221df
SHA512

ac3205373d0b033d27bc6fd512f4fd9f846fb9eceb6deee3f98c9cb18a2efc7f48528a9640d68ec99c730e4b1ab621b48331aeb5c2b2c3364d056f28e5aa0c82
SSDEEP

768:zNSAIUosOwM3Aydk3bLn2EFjTclnihcoAwFPOgqub4osOwMQNSAIffAaDEOjL63I:zNdaw6Aydk3bjPOgquZwNNdgAaDEOjLL

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{03C02E61-2B82-11EF-9266-767D26DA5D32} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "424664158"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000005ec80cf279b2564c91633e21940a807600000000020000000000106600000001000020000000ba7428bd9ecb7a6c497a08b6452105c0f3ae81c5ade08f1e0f53276ffc33a2f9000000000e8000000002000020000000414b4be47e24258512b2e091638bf02f76452b1b88cf2f66da7bfa5d5f7df36320000000b69c7d1c52ad43ed2a5cd44fbc9f643a5c9aab7dd3a7203ed7b6759b89c3d5fc40000000aeb6873e90e3b5f665a571c3891f8150ca674e216ad5376e75a361803724a384bf96a3487c282a481368265094dd30609afa5fc6832eb928a42e9b4ec51f66a9	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000005ec80cf279b2564c91633e21940a807600000000020000000000106600000001000020000000c7f3c04bf12c3f2526957a791d9035456244994fd51e1e72858b4cb9feed71a7000000000e800000000200002000000034d670d28d42619e6ce5fa7108fc00f3627679a8e5dbed49192fe928a48bb629900000005d5facf43839b241431b4359b9b70e9981799c47b27426178f5d2359241e4abda927d4d2c4a1cacde250809bd763ec07085bbac92f08ca03cc6c95a032144eb1ad142ca48e18da0dff2d713e34721fbd3814b036845835deca54e9753f459fff59d6b32f5bbaadfa8ce669d12aeee60891e4270c9e3b2e5e38703833b29ecbdb9abb40faa605db7e473a473fcc72ee3740000000b303017f9f041f8d41ebca350a96b2d6fce9147a3bb77f9e395a44c9bae2e2709a8398e5176cf999d3535211deeaa404ff44472fc7d0671fc9f317e21d4c8d15	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 900b10f28ebfda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2840	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2840	iexplore.exe
2840	iexplore.exe
2924	IEXPLORE.EXE
2924	IEXPLORE.EXE
2924	IEXPLORE.EXE
2924	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2840 wrote to memory of 2924	2840	iexplore.exe	28
PID 2840 wrote to memory of 2924	2840	iexplore.exe	28
PID 2840 wrote to memory of 2924	2840	iexplore.exe	28
PID 2840 wrote to memory of 2924	2840	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\b12a5ce4d673146e9dea7926d3307763_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2840
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2840 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2924

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
72a4b4c49cfd7e7e356f85a626486745

SHA1
8a6b7317e9d89a854309b532675bf9656124be96

SHA256
7d062a07e6e5cd579f6c53a003dd8ec56631323825c498434550cda918ca2faa

SHA512
b3b4a5c87a0094970655c3372bf30bcfc965d6e61d50353cf827521cebd8b663a4e4c599b25ea85a2a9313d59362a41262a41e87415179719a2f33af7be11fcd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8909c77564ec542243ee40621e69630b

SHA1
1337ecacc6f64d79daad913073619ba41eb4fb22

SHA256
7d73d5dcace4553c0bf03081eb7dfc857252ea4e2ea9686b72fb99769f8cf3ac

SHA512
9ab41e92d1004216d8a695fa8d738b826cbf7ac20e1be4d078bc170325f676b69e3b9f16d182701bbff6630a13aefee4c1b0782df18eb8f71609cc3ae62fe5ed

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
bc1cc051a307df5932c20ad51564aab3

SHA1
a6f0f6f8a3a973aedf460b6e507e68bc04d75922

SHA256
3be6ddb52f642aa12e1f01fb82c62f229770e24a041a288bb9213174766d0cf1

SHA512
b7992ae5cacb7328c4722fa08d1559d68e3e4dbb4d68ee103717f93b1d9f26ed5c6a4b255d21db5c76cc64e146b115feac57d9123ae37e779dd1487ea1ca0398

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ca616c82eb31c307867c7327ed52be6c

SHA1
2f42dc722319f73847e4a60461bfd19b6bb7a665

SHA256
21aa589f6b3b8202877e7a508661547b06ce877f79803ed12ecaeaa5fa66be2d

SHA512
5a0c97e99c8570ad12d2ccefb7c580b0b2ff56a946b9c4431d384c1cc6e66d951de20cf1ba3e2780210b73ae52d79830d5452d4b8dcbfd8f2dd8403d394bbade

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3dc29cbbc69a2e60509246c36abf2ab5

SHA1
e1cc091aeaee5cd937877f7102a55c9a37b87252

SHA256
a6c8880e2fade96793b8db116ce65186306983e8211563bbdddc7ef7d2614e3c

SHA512
b4d5b3119b6d29b1b399f6cd1edcf76dca3f064de860ab241c3e4a717c8a8dea88338d78d66a0b9b70d05b79882679e8f0c2f51fe9b63254883f7b0376cda1f2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
30e3b11b79ed46cd26b096b982f494f3

SHA1
a8776fe3204babf7008c4221e8ab9404b5b799d4

SHA256
bb46fa07831d0d148c421beb10267070f5fa4b3b0e14eeb363f867d7e0c29e6c

SHA512
af2f16809ff6be3b0018acad62ebd71602f9630b4fa877085828be2f9200168da1f82f58050c675c946265e3ea5d99c7c136dbd94a4c375c9f6111e0363717a7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
890fb6ead4404a175ec883eb2ef25498

SHA1
a8d0db6aaeda44ad921d2ec2f577cf5f58b1e97c

SHA256
8266dd8617a961888ab1cc73d2df7cad37cf2a57f0f01019f1edb3bff2413f44

SHA512
7161e09048686725091d3e80d2a5c584c9bdee3a77164881632299f3862e0dcb34be458106c7f1b5cb8f89ce054c5900c1b6e893d903d133f653802f31c15190

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9e99a202a3109ad98f8a1b828cde2ee9

SHA1
fe7401d0b9ba207e32e1369b607d9be5614fda82

SHA256
a321eac6ece501998473be119f88f62f6bd17a209fb9ee2de28e3835ef4ccd8b

SHA512
ea1ce3f8bd1ff0c6bd50cd4f9ee8583c4ec5684c45fafc028e9757c37bd6bbff891075e62c0487a8a9e1b1216981abb12f2a88a91fe43872c25b8afd9494d117

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b225399fa14ad08de72c8b099ffd4688

SHA1
9bd2aae2d24920535ae0688ebfc980569448fd98

SHA256
0a9fb33817217bebce399f8c2771d1dae283b598c30cb7b4070c62679ee96744

SHA512
5679c275d05df7f01b3946b94a68612d32e3d93eacfebe37a4eb1ccc64291515a37f6eb4cc96b91afcd2105523072979480677392b5626756116372364f7096d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
60b7a2115581808ba9b358bb78bae5b3

SHA1
4f3e5f82af21c12a3ae2f2731bf0f2408eb72ec2

SHA256
154722691a90555c127b1df8a1d2883cc0436a454d42a3ec5f6c458ca3b33e9b

SHA512
95b5732bdb58ba30eefbd4d006b772902f94bf43bb40e2a6860c4a10fe9f8eefa7e042db143042ad15f3ea926620171ca846558a30ddbccf99f6e3d55e5cf9b3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
45060ce37d33d15dfbd201b610a4700a

SHA1
cab360c24607229af7eebf86acd1a7952401cee9

SHA256
b648d1ca9555aae2811bd5b1f823ecc57b260406fc31d39a67357c0cab5c50ed

SHA512
2c9d75fb8ca3b0e0513af0f86a563c2b84efb11f8270974cc4c222ccc8cce94acf3b6805e90b0b0ff58da3074ab03646990149c386e54f125f8465c4d66b0313

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a24060b5c8a9dd378665aebea9e5dbec

SHA1
6d237f79ced43f0024404e01629b3fdcf5a0f228

SHA256
8ccdcd27b011338c8fb74a525038643059d41f1cc204ecf1566a4a9b708bf312

SHA512
fba494540940f5b7f31d33c73294d66a0c938c4ba8ccbb5ea87d5ea32757595eaa2ea49025ae364b7d7d2f7debe9e79cac0bc0b7ff085cc28ee7677a4dea01d6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4da9df90cb780b5bb62838e9f80773e3

SHA1
de6155a0e393301ebe9591418699264afd1deeaf

SHA256
341d5944e347a4982a15e7a4b68571ce5a2b2729a1633d6bf0fd2cace722b9f6

SHA512
0c1fc22a22551945a87bec66c087627782dddac754e54e50eff7310e7ba09541ec11eeca7a6c5a1211a3d5352127c3342d10db014c44545276dc2642e933b141

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2b1b05e939f1979b70aaad8cf841e979

SHA1
90bddb89e8f6609f817df0f79039e15ebc7799e0

SHA256
82f2aef7311360de6092bb03377cdf91cd9f68ee8a00f2f5c9253a2c3a9a20f1

SHA512
4c79fc08fb64f25b4a49ac5bb39e34ccd68ee4a68400368bf8eb473f0ccd3ee2fcf28ab3a7d85ca6bbecf0584590a565a6102c1952b09d2117c6caf220ecd7c7

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab18EF.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar18F0.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit