91f088598823beb5519b9b58269dac940029b9c31288019525c57a7ec9ba561f

Analysis

max time kernel
120s
max time network
128s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
17/06/2024, 05:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b70ae7a3670ce4b33b8c640771ca465d_JaffaCakes118.html
Size

460KB
MD5

b70ae7a3670ce4b33b8c640771ca465d
SHA1

342546cc3b0d0e27ec9c07f4ca25fdc52bb4c3ca
SHA256

91f088598823beb5519b9b58269dac940029b9c31288019525c57a7ec9ba561f
SHA512

2b66ff35e6b2119744c1cfff7362c009f647310ce77dda4ac25db1168a3a05853850b10df1391584fd7c6f7e4b9700f6e78aaec1cc70a31f3d0990250973d99b
SSDEEP

6144:S0sMYod+X3oI+YesMYod+X3oI+Y5sMYod+X3oI+YLsMYod+X3oI+YQ:55d+X3e5d+X3n5d+X315d+X3+

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 30d3c7dc79c0da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000026d7560f1714c14a9107011ea08fd6cc00000000020000000000106600000001000020000000126cc5fdceb52f0b355abd97ac0b41eeec60e7be6813a82e879338d0a427a59e000000000e800000000200002000000020a663b4bccea83b4981b1d93f9e01c01fd0b14d42bd71239b9bae2864067ac6900000003b41af26a46165c82e6518b73c736124ad3feabbbce04a6319f34941669218a30f1e0c54446c4ae3b98b7632bd250cae763b08b64c03cfe2df4e3857196c84e0e9b2d73bd37350000d32328c25058e158d15550417379d8915963295a4d7e32d553bc31c358cb8a5587b5a23a8d10ed63cdd957e4d0b29b6f4c8641cbef38c7d074afbb766bc8abaf2ecdf7efac558594000000064da9e7c363454fffb5ee530ffe26de1ff7cb38045d6d9a6e5d0e7b58ac7a5df3e15842cfac7332fbb10aad26035d5989a26bb1bb3ea9dc1b567bb0f4d7c2984	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000026d7560f1714c14a9107011ea08fd6cc00000000020000000000106600000001000020000000bf43509dd565304280d805a2db37bfaa0d7136e5438dfff7bf20c271580ea5d8000000000e80000000020000200000001610f9a35c968f3b77424327d44683b0278e9d7cbff935db324774c9874310d42000000017e7870abb06887a6022c78adf2b3e82a9794502dc795ea402ca9a53ff14393940000000607d03a8acd6f9ce4ea942172ad7916faedea5a2d2cb6818186a2b354a206813dc38ca4cf0beb171ec8c3efddddeb9854eb928147ba0ae50e56d7f86cd74a8ee	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "424765088"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{042ED451-2C6D-11EF-B1D1-D2EFD46A7D0E} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2864	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2864	iexplore.exe
2864	iexplore.exe
2860	IEXPLORE.EXE
2860	IEXPLORE.EXE
2860	IEXPLORE.EXE
2860	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2864 wrote to memory of 2860	2864	iexplore.exe	28
PID 2864 wrote to memory of 2860	2864	iexplore.exe	28
PID 2864 wrote to memory of 2860	2864	iexplore.exe	28
PID 2864 wrote to memory of 2860	2864	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\b70ae7a3670ce4b33b8c640771ca465d_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2864
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2864 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2860

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a084bec71a92be509ac9cd0c8211e486

SHA1
3c0d2eef5807d704c583ec294ca711ccbf38c353

SHA256
4d723420cf7c50ac7841c53ea6df68ebc8089ab4e186ebfc8eb5d45938767c90

SHA512
122144383698f3d35d4b283869e5124e621a83047e61040f514dd85946b9a4fab1e67c7ec579cce350706fa989b9faeded4c8b817d034755f0ae322508fbcb6b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3c80d0d488f04799b77daa78a6d2995e

SHA1
91734c2f835455c7a3e17a3969a3747ab0152792

SHA256
bbc59055616c43325c534a09d63b6bcc0564c7ed47a08e3ff66b130957e773e9

SHA512
e71e7a654222c8c5c7f7ee3a246ac59201cf844ddda0646ab303582ef57b61c6c6f21d7e5676f222a29a14b049ca39d26895040859cc9d4acadd58a022b223b1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
46b5fc18b5f4824fdd0136418958865f

SHA1
2fc66141c4ea24606990143a2b3189424ee56adb

SHA256
faae259527d9146730694501fc9b0948ca5b0e9c6142d249960e334bd1a88f82

SHA512
9489afa17c06ef102c3d5bdf5eeffeb97949c9bdafd01622af4f3815964f017c624707b730fd59ad71d2ca2aa6741900f5b6001da7bd083e78c0a1f10a9dc423

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
bf3cd0bdd6ec4fb00caf54b1fa543e8a

SHA1
87aeba146a7b2df9272a60da2e16ae85050096b3

SHA256
18aad8ee9ed9f46a06c37b0b5fb9ef24f452576ed12f74238ea7f3895935ab23

SHA512
ced28d86ce7aeeb031b7580662550d5c3955fddd6fcd2b3dac984f6568e5463d7658e52fa6b9cbf5cd5cfe0ab172c77bd17bd13311c38502fa1d713db58e8eda

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4e5e06aa6f5d3f669fddf14d7e8305d0

SHA1
309e0c90e6d104fdbb81d40b05b89de5552a8094

SHA256
e2961c0b4fecc1fb056fb3a612ab078f5e304e93834ae59749e74297244a84f2

SHA512
f2affe31683c42c074b1bb5047f33dedbcca79e22fc877c17250669fd0aabd199f480742019c1cb55c5b970c5849b22d5f8fd01aed17099dd8538f96ccc930d3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a3ef0429139b1ac37f996853d2b658d7

SHA1
71e7bd3100cfb7338788abc65f8c1f8cbf5474cf

SHA256
09432fa7aeb794bd6740d42b79d4affed6c49d72c0ef8a0b55580f8a5fb30b77

SHA512
84ee99f6c6c1440d8e7da61309aa646b59400ec5e3cd1c9328e700f61bee6f6c59650f40f87808f395729cb28aa3df5568cadf74d35a18059e12f3a164c07b72

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d4369bcd2e1982d13ded39858e74aa37

SHA1
a4f24d49fadba42623b7e4546dfe83650c284b74

SHA256
06eaaf3f4cd63c409d7e8fbf9d1634f5c090b8dc32a9276fb22675fad1a9ebc3

SHA512
30e08e8e6f023c4216d47077e336e12ab8d2c46abd0c34937ec78c877b7d5c12a44fa61f5d7e90358beec511a711f348a73d65133a227fdf1d42e3e7d9818e7f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
58b7bc8003fa8da1ef0c39924569c9a1

SHA1
6bd264db275a8e5230d847988dc10a4ef676f14e

SHA256
052eb8dc0c7fa5d9ef09cae4fc95f1ca569ab8084850cd58622623a96e05d73a

SHA512
8905780d2fd0291e3df7ffdd6692fef683ec7620060af29cffc4c1cee766ef89dc9d0ce5b37fb5702ddc2a04455c7d33ce763523b67c78dbe44ca0018365ed7e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a679a8dd3c2f39267a612a637f471d12

SHA1
a767aedcd372fe9ead83fc351b9b5561c725525a

SHA256
7a1876b9ea447af6817d5d3d3d3b1d9907912e8f1647762fb7f633f00c71c2ea

SHA512
b95b5b7d724e810ddf519223391e1c14774b813a6d5ae5e88c861f37cd5a99af75297fe0acd0285bc0537cc3de22b58154820447f775a93b7d5d7485939391fe

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
866faa6ce3484846a50e1cc399690f40

SHA1
d981065faf481f668649bd6b3452682f88c51e2e

SHA256
1a53d4c34d7d61d5fcd2632ee2c17bc3e2b15abb8f3459fbe19d387767418434

SHA512
5c93e77eaa1b6de157952afe94ababfaa1fa4f7ef16a5a2f8d15a9ab63b6bb2fb8ad2d7ec9555afc7855b39959eef0c4bfa965ba41946b469e95fda13e726366

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d5aba7424cfc6ade42c55759657677cb

SHA1
7c1c9e141ed2fa2b77597d19bca329eb2af315e8

SHA256
4043e938449c6ef8241764fe5ecb7a7f8e49772134b1cece5a74184bac94c227

SHA512
bd5f02f609c58cf659039289eca2cedcb075d2c1d79a7dd6cb153568cfbefc16fe9368d98f8ea2e0558d4f71fb987750d83ca75a13c55893f0b5a56d117e47cc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8367198d46ef36459945ce6ff565029c

SHA1
c0a8b24331a39766e4aeb58d53f4290a22cde846

SHA256
f41fa1d80cc5b10b2f9d8de29593f0c74da0a8e5e87a05750326ba1820b07113

SHA512
3e93de7fcf14e1a8218b8781757acf386a7119480fd4fc941b61b3fe7b95c583aafc0978e4dc70a51aedcccfb936c8fd1d592f58188d824db0901153c99c076e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
241df875f0533b72eb9aa4d59dd1dc35

SHA1
c17307bc1d84b5162ceb0af6b8dba0bf761c46ff

SHA256
0794d518763a4a8162df86f588d1e3485432b1e2bcfbc21a8e732c8475d4bb6b

SHA512
b6fe94b38369d1a99a00600675dba531d99119cbdaf341c6dd162ab992fc05b1ad0af8cf8f3da183b54f98cd2ac8deaa2408b7c36970c11c65f76de0ca44806b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0f740f4268d2696df537553fe1e5b03b

SHA1
0d39304210fb21a4359ed6f2bd52e2fbb2e2c243

SHA256
b62a1fbb3af45f70189299ad0bd279310b3970bda17f94f66b9ddcdb93cb2c6a

SHA512
b5e38b8e404f3ad3e7c40051b5097a4e2e1ceda8747464bbfd974f5da384be7a672a5a5381bc3aa392aa35807b11b0e41d0a62a52e85e32ce7477571906ab801

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3432595803b8cf83f6d2cee26dec7ced

SHA1
8df4b57ef62cc691b803de0a0e752d55f762fe7e

SHA256
48046675ad420917757a41bed529704e6dbef98787d4760d5ee7bdaa38d36b32

SHA512
966b997401a708f60c04398f19a79384a26106ec5da22d8e3046dd7d5fd9b4da3b39a40d8c47166b6de7941e5f7f815e6fd55ba2d8f5926f14b9d1113c79650a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
068e280c47780651a55983fc06a7f730

SHA1
2ef0eafb407fae2dacacaf9e514f15106a52897b

SHA256
0901312d27e3d33445f9880a799f97bf6b055feed305e540c6bfa00269825164

SHA512
004367c5f0a04ce40da4d389c51fec7ff5986c9a2617810dc3c0bfd5491061d2804f98d3c0e4ae535b99078969f87c9df973617e3d03faa65221f4c48ed930d2

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab5015.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar5136.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit