d6988f21d3fbb1c5a62be8486260c8f8ec710e48a48ba6d522469cdea07cade4

Analysis

max time kernel
121s
max time network
127s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
24/06/2024, 00:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0535e903c03ea39c7143deabacf2344e_JaffaCakes118.html
Size

9KB
MD5

0535e903c03ea39c7143deabacf2344e
SHA1

37475ff251bd386afe9411acf2053c2cd897c1a5
SHA256

d6988f21d3fbb1c5a62be8486260c8f8ec710e48a48ba6d522469cdea07cade4
SHA512

9ca70b427891499dfd768888697043f5f4a3da01c8933d1dfcd6074c39be7e84533d0a1ef71ef2f490a7a08b2019b28f068c376d7671037d1be7a3f5be765983
SSDEEP

96:uzVs+ux7yTLLY1k9o84d12ef7CSTUpGT/kPsrpUlVHcEZ7ru7f:csz7yTAYS/IAUPHb76f

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d7c7e73b934388418857a0db8be9c1d100000000020000000000106600000001000020000000c4e3cd89bf1849d5aa19be42a980a4e190601b5331951a89492af6a05186bb85000000000e8000000002000020000000287441c2507fc7ad6d98de4b8394568948815610ceea3344235aeb8e71d45ea720000000d81897f622989dd79c7e9aa1467c3a02440f900cbfd701aaa333093d1f5a6fb8400000001c42237710aade07981d348dc1dbe76294051c37bd8f0d25a9f15ebdccfcd27614cb54a7260af4bc33b50992f59e32352047e299a6496e26d810b07ed1cda482	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d7c7e73b934388418857a0db8be9c1d100000000020000000000106600000001000020000000e43e0bd054e893f75684666b512242ca60d0fcfa954d2fa80022a62f1ef250d4000000000e8000000002000020000000884bec285fb1d14e84111262027b070fff34b7327c63075cb059b0f00aa0a77b90000000d33969a72791c5cd6fa3c87e43247cc7093aa46fb2a0c8734befb693b59a7f59670d12682e06e3425363a55c52ef6204d19eb270067afdf60e5856a45063bf4b2d3dc5309c4696e3fb5181f5ee80bab4a9e95f4a5d6765052f6feee29b677cf610412d7a308a09570d8737ef205737aec4d6e18f67e557ca1390ab72a45386f2d0ab76ee20e0e40792376e1612cd8f6040000000f7554e17a2deb496ebae38322d892320393facc17eff7e24666ad3142b7c96bb74052c22c2299a1cafb6255e4f795f23cba23b32374f9a55a399cc74ef816778	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{A32FC1D1-31BE-11EF-B837-5AD7C7D11D06} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "425349899"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 80a6b678cbc5da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2440	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2440	iexplore.exe
2440	iexplore.exe
2712	IEXPLORE.EXE
2712	IEXPLORE.EXE
2712	IEXPLORE.EXE
2712	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2440 wrote to memory of 2712	2440	iexplore.exe	28
PID 2440 wrote to memory of 2712	2440	iexplore.exe	28
PID 2440 wrote to memory of 2712	2440	iexplore.exe	28
PID 2440 wrote to memory of 2712	2440	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\0535e903c03ea39c7143deabacf2344e_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2440
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2440 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2712

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
85904d0a6661ec7eca961178a543b7f3

SHA1
f2827e765f3d751c15334a1083ba799e7d77471b

SHA256
229c6221bc54c82185b4a2415ec99e49e0c8149a0bade46d2bc69bc9be0cafb9

SHA512
5d122dc67d2d86eb2b903d5666a90ad4aabc172f9efc3cfa4cd07738cb85955fabedadaa11311ac0cc8b26bd6a906682552fd7439991cbf55a1dd367bdf8ae0b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1f7dd95400e38a8fc5126785252964d4

SHA1
e16410fb356e0fe57c1ff8039e78ab5f9097721c

SHA256
2613aa9993a0c95a73d54fa61e807393987d2eb6dd06c93441b0718f60eabc94

SHA512
44d67ea63dd852d58b867dccdd402f5e1e4a1244c3892d722e685cd91fdc9b0dc3c7d62a8559ce5a3136b0ababe55c803b8038de0fff2602794611e0b84ca158

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f185c63a734de91e076009ab6c691af1

SHA1
dea97d973851041f4323e9e47979a2103ccd39fb

SHA256
528b082c8620ee29f431a6746e792dd862d7883a664d67b892f51fd3c16f6ad8

SHA512
693a6648f20139c1601d40d231b0035a962459f3ac3bcea6f74c4de4cb0f12162949f9cda9c6a08d6648dc8e3d42874bcc6a612b207fe189e3d896d3b634329b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
08dbf77d82733276cadec3a18aa8a44f

SHA1
d10301560bb72a8cce691ea659d7ffd4ce224c1f

SHA256
ed1911eebe822c4e36b034387a1bfa2e47e1352d8954e1aa2793c5d3abf502db

SHA512
378083e66da03212cb3736aa5df57d80232981e908094e6ee89ab25722aca4f6ef34fcfdca9fb1de46a729cfcc40d8e78efc944baf2d765fc8cc8a6509c8af89

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
815f51df5d85eb6c751c1d1d8034091a

SHA1
07d025dd3d6f05e0c528c170263bd31d2b7facbf

SHA256
241805d064d74192b86bc0c2df75dfca42d04db68b919e1b8217d816b7a3d4ce

SHA512
98550a9948cbafdb94d5b48846912956834feeee09d56d9aecc42986cb7d51c594841d4617b0c1a34fc2aa2b0075047c7b999b5c8e626f95d066c4ec16f60f66

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
58efca2021c6bc462f1f43662ba6a10c

SHA1
bc718879754e0fb02c85bacde463da1a0abe25fb

SHA256
16e88e7370cbfafe99f767a9e70a5722a250dac45016a90e8a51358ef1faa465

SHA512
497dbfc0a20466800d75922355a751727943ef00b80015c33053bd23d5267cfc5923a2390e75d5b65ab3f58a8af732ca57796ae4d9d99e51ca5aaa12fb6362a5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
167a4ba2dcf810cd5a10e4c068a477ef

SHA1
190e292adf8283e3c43a617cd0daec07a752ace1

SHA256
be3f112cca556408e3408fef0a353dc63c59250290a8c6908ceea26db74d9a4a

SHA512
00e912ee1d6431b8164b5d67b5d83a36725c95bfceb1c6f0f658e473aed1f7e2dc46492499e939f25d15bc260264e45e5f1360acb38ae8a54bf1562287d35b1a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1edcfda3a69fac1f1bfd115693f9782b

SHA1
d4f8a8f249e68adcf28a44cc1555c5fb27eb6dc7

SHA256
57a500bb24b52b8a9c51cbb393d6f32469fcc40b015e130537319ad778147274

SHA512
861bf524a882bec1e1f443605da466f52ff3a83430585f7ea905ca869dda16a75b3160f33247652e75fa51e87f5188181760d09d3cce632b182938231c512fb7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1f500cfa8d1287c9953190d5c451d931

SHA1
df6f2c9f100934044910f6555309a1b4382088b5

SHA256
63fa69ed26a04bf1a54ed81ac0426851d16c367442fd22a93c0a8a42e9fea211

SHA512
4ed046f37fcb26de82d6965f7677081fe37966bca1238c301f7798e998ba31655b6ddfdcf352a812aae7f0e269a5d0b9b2c4e78be2f049674fd62c2850e5c624

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0c765cc845accdade743e9c888c48fdc

SHA1
ceb73dafaa82dfd1056fa0567b6f0f3062165ded

SHA256
28c6cf0fcd31794f591d066e0ca6fa964974c63e57a0ae22a15b3aad11ca1e83

SHA512
f521f42a5ae516a0ca064ddc3190006a04415953f7a0a7e5be5f2cf5e64565f0d2bda1464f3b294304e3837df1e69bd8e27b05eb48c50d312cc64163c5a56f23

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0a150ba506c494cc5c999a550c73e82b

SHA1
ee96a96689a8881a000494894731123b5ec5137b

SHA256
a27383f4a78c98e95f1fc9d599db311aea38f4c4f9ea252c5c922d79e5f087d1

SHA512
5f5de81f89e6d5b4a9b4654c2ab57df5130d8c315224c129efaf0d1855b29a4e60ee8307a604ab0d53852d620b31d1734203721ceea5764120c1635b86c38edc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
79d0551c5ba71a23b9db5a6f7d579447

SHA1
418a5db76978bb1be9b95d99ad135ecd70d1efdd

SHA256
c38cac1c905a625b2c18ebbf319c5cf51b3239c75b149771e00457fc75d2a173

SHA512
9322cc009209aabf06d74a6ab9c1e53f5a298390d99c8f4e7fb88fd98e2d0bd439a3d8a938a163dd68b85598c4d1344d0f2750fda1ced34789ca66407a857b0d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f1ed091277b4fc12cc3a8f90f9a6d219

SHA1
f75060004f5dd942fd5e8f79bf79c1cc2d8963e4

SHA256
c0b4cbd5e9dae48748c6f3b55f7144ba18eae9ee85f9c1030ca492cf9200fbcc

SHA512
158f75ba5d59d61897c3a09202d33a216abd6f41e6531e014d09bb5227578264ac5b4bac4ad4d3dbd2ff2f66663fecd4c4d11b0c651ed3a165aa75cc54b9d66e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5bf251ddb3017cb1d8ab81b4789f6302

SHA1
e1f338f66256f4e7444cb4a610322e4eb729b940

SHA256
9df84b440177d02382ba3725d30555637d8277139a849aeb344975ecd2d630d1

SHA512
caeff9a67d24754fda570f9e490db0ba6a12a55486d9ef11397757ce89eb4d0dfe53b11526f075f18b58efb2e43de8757b7fe0f1a8df9428d7ad5a0eb455d861

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7206938f913637827cbbf0f3b598a741

SHA1
db63ef90ac36482182dd9e001883b54d4d476a08

SHA256
854bcf9de0c1e7380baccf59cc227797a659be900ce9689f9c2b60887c96b561

SHA512
09c62f4c7fca711dd8d9191171de27650900c97565ab47e9d530e6409dc9d7e07192ce32e33df2557b2cf14964af218ff81450672f7892524644e24fa9b22aef

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab2AAB.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar302F.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit