96ac87fe8474a6d299aebbce94c2e80aeace74d1cbc72a3e1ee7ac1d53e04086

Analysis

max time kernel
118s
max time network
127s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
25/06/2024, 23:59

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

1002dafa173db2f1c23ed395b2f73537_JaffaCakes118.html
Size

53KB
MD5

1002dafa173db2f1c23ed395b2f73537
SHA1

d9ea4578d0a657aa09d717557f4877866bb7aea7
SHA256

96ac87fe8474a6d299aebbce94c2e80aeace74d1cbc72a3e1ee7ac1d53e04086
SHA512

e1d0c6b37d1818c25c774bbeec2d2699d407f7a3918c67ae9aff6960ce7fa23eb277130a7d95df5b132465c2310084da2afbb148339bdd450897c267dd2fec28
SSDEEP

1536:CkgUiIakTqGivi+PyUmrunlYm63Nj+q5Vy0R0w2AzTICbbQoP/t9M/dNwIUTDmDR:CkgUiIakTqGivi+PyUmrunlYm63Nj+qq

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = b06ebedc5bc7da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{06EDE671-334F-11EF-B9DB-4A2B752F9250} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000000b2968c6cf60b74b94229c882944fb8100000000020000000000106600000001000020000000392311a872351af198252b71425022df2c16178db090283390e41a8fe2cefc5d000000000e8000000002000020000000df1963fb3209ee3b8c955b5583249c9ed674e3657f00d806b462eed3de979144200000005170d58320a19c69ebe7f2510fe51a79008d01457c8e0bb63e9069e0f578eeba40000000a3d66f730964ca2abc4e0d2c39076b24302841fef3b61040275fd2e5f284d2a8f064fbe84e9d9f36884fa3e1ed1f70a04e0ec6f076c16d9c1662539a5e6a9929	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000000b2968c6cf60b74b94229c882944fb81000000000200000000001066000000010000200000007b0b03aa6d8a98883407dd652fe4104d1eb3665c849da7a463047e1e5c4c7ed9000000000e80000000020000200000001dc639f9b1dc1f8c977768302850db53e2ad59fae0b4dec4d385afa3c3392b529000000096e4a18b5e06bd28860912d94faaa2be2778fdbd4f34eaff2a9207b47188d9ba6dd5474ef53b35e9f79c454b28339285521550a33ad49491699349a9a37af311354a201c19ff967fe3ba1ac411b7388cbc65bdf6ec0a5334b85513a9faf0fcd0abe69f437f7109fac25157953580d7ac67bd9cacd31bd5e6620ac6b326e5172e0b3985155f983e631846583dc3b9556840000000f6558126c1934e6f97f7248d32163463af141b758e42ce461e2dab2e039d2b18aae44541dac95111de8647ad801c68356259eb52ca56710383a272755ce0b69d	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "425521866"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1936	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1936	iexplore.exe
1936	iexplore.exe
2100	IEXPLORE.EXE
2100	IEXPLORE.EXE
2100	IEXPLORE.EXE
2100	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1936 wrote to memory of 2100	1936	iexplore.exe	28
PID 1936 wrote to memory of 2100	1936	iexplore.exe	28
PID 1936 wrote to memory of 2100	1936	iexplore.exe	28
PID 1936 wrote to memory of 2100	1936	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\1002dafa173db2f1c23ed395b2f73537_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1936
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1936 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2100

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6945eafad72a8cb5c6ca0a1d3915a096

SHA1
877989cc43ff6c08a70e280267011e46ed871802

SHA256
a813883fdc41abc87912e640efc0b7dc01467fd4b1247edf02d7c25feb1fd04c

SHA512
c221b46bfe97158b9557aab5fa06205b6f8414ba0c67ece0ebe891f9c8de63e8b099a8a8f0ef90ef6c22ce68d1b81be710fd084a52248125394d2a2eecafe68f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f82f2bc74bb65a39a12f4e28564f9845

SHA1
52dda42b62bc4e84438f5e67b6e53cc56d4a8122

SHA256
de0ee691bae3315f4bde233801ecb7bff237a9943506c7d7b660f34ee57e2588

SHA512
1dcfa3956f0de42fcb96d92a69f14f40e9819249d71588ef0af0e0e1459f4f7546adf897e0346bf3a09e88b06a35dd680f943d5c405b9f461e4a55c7793e95a3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
39447d2d28fc4cddc77ec0dbb4b7da6b

SHA1
40b0b8afd66f8e82b12ed052115f7e6597362bf4

SHA256
101963d9662d32b267a7b20661fa86f135ee4e86955f847d32454535c3f03d99

SHA512
99edaaa9e941de4261e56522324c2d701bf576e5704d1bb123fa2c0ed131d259e0dc8c78abb01ecb33812e623046cccf4a55b321fe59e8df4edfefc343c4f48a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
798e4592ce55c7de3ad4e6a1301b4dc2

SHA1
cac09d73b14ed6a481e623b59ed36937cf901ba1

SHA256
76c06bd5d8d91399b349ed92bd1c2e92adf4301028e42f495fe6d2dc2d3c40b8

SHA512
43fe3ac2f591962f3ca930073fadde464ab2012b7eb39b10a1fb209d90c6a9bace3f1b577a81d911df4b415d0073546d1b5a492197ff9265bbb7c94d9040c0fb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ca51b24dd83ae6d2501e8eaf521091ca

SHA1
e1c48fca4c73a87a2c84066c7ccf3a1007cffb96

SHA256
3cbfe0849b61a93172d47d873c2fae9f45f6d7ddaf17980bddb7e521f2de5f71

SHA512
b79d9d02fc9ba3b27324a7062c8ee3539785053b6d9a4c4434186c850b08aee2ee68affd8987b815f0f8844bfff73c5a586d8f14dcaa7c90325680642cc7b07e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
51063caa3867bd7b059ab2e789747936

SHA1
acbbcb4d256f25b855b9fdbbbc3d6a2afd372d0c

SHA256
d9bf1f10bfa9381d230aef0063ad34feea623b184e3e266e5bcc7409ac399483

SHA512
ec1cb212002904522bca8fb92dd740734957b4923bf502c263cea38d61671cc2db61d2a03bf80d9acaac9c45caa33ef00d8cc304e62e59e9bcee2ba62c0ae70c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e3237d08b6a1ddb743bd3dadac4e0c7c

SHA1
bff48ea474db237d2460cabcdea3c0a009e36ef5

SHA256
de03244f193371abc8b84e19bb672a3ae2303c6bd8edba0b97e6e988bba77db8

SHA512
535a0db29b1b54ef1b6ad091b8269cf945b2c38c609a5a3ef88ac21c2f49a855c2b22c97641bd79446dab6c4c89e25ebd2c5aded719b48badd99258f45d5581d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9996cd93155cc26a5ae387b1c304dda0

SHA1
6148d6e78e68443d659c3decea28ec1bb8420e3a

SHA256
33eec991c2cb0ddc05069339f88320436b867f6e615eead2e78ea5bb582cdaf2

SHA512
da782b08c648b8300cb0a21d02e7572591be4339e7757eccc7632c2953a8c73be9ea6cabbd3ad9a3825fce06220aca32f743e2358f6adfa4aed109545b94603c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
26b40c8fc8b90dae997ece98ce674e34

SHA1
872985d252d8b734ae06f109cc59d918a0b90496

SHA256
33354514835974a07b3e08403202ba76df1ce1ff0def361668dd3788a44461f4

SHA512
9b618dcac0167194ccd9ba7482d668613c5652ba44e2f58545b77c80fa8c802487600703566b3651dac6ecdbf26c77aaef07d36fda8d0719ba261ef8bb0291f1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
41cbc695f3e4ae41973b6e131e508b28

SHA1
b6fffa049c3f87a5b6227f95cc95ddff3d8ea16d

SHA256
d844d14e5b563a4bfc5e15c8b32b43403b0dd9e9980721988810e2af77357117

SHA512
eaa3fdfb27b3153b5abb15509db8d3c1f418fafe920a05d27ba6bd913e94e3a910b8ac3d6ccd6854b69d02e5b7d2b8d38b664815f2c6b8342b774ef09e53fce6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7fa86772df78ae47c080f2ef27e8e151

SHA1
180b27ae0510557b248ad437d2437db30c62cd12

SHA256
7ac4fe74d9c21115bf37c9fb100eb87e06e87c65296b78ae006386033cb5d44e

SHA512
b55cd3d1aadcc2dce0fffc3bfe93a3822a1e51727f9d3b2de6fe83f6a2bcb8367dd56be95ea1c5fd67dd84dfe9777caad3dc2580e12f29337117539ea9ee8388

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\FY3LN490\style[1].htm

Filesize
706B

MD5
67f3a5933c17b3ab044826d3927d0ba9

SHA1
5957076d09bacaa6db8ddc832b4fd87ed8f05f8a

SHA256
97e800f4836b7030dd58fe6296294b7ff5ef1b5eb0e88353f230ea1608d2bb64

SHA512
03ba224055ffdbf32b7eea30c764dc18d66cc6d8707dc5fafab74e155b0bb3d4d691c5788b033a68f05299547297125122778fa7e3252f93e7343d918936643e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab4119.tmp

Filesize
67KB

MD5
2d3dcf90f6c99f47e7593ea250c9e749

SHA1
51be82be4a272669983313565b4940d4b1385237

SHA256
8714e7be9f9b6de26673d9d09bd4c9f41b1b27ae10b1d56a7ad83abd7430ebd4

SHA512
9c11dd7d448ffebe2167acde37be77d42175edacf5aaf6fb31d3bdfe6bb1f63f5fdbc9a0a2125ed9d5ce0529b6b548818c8021532e1ea6b324717cc9bec0aaa5

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar42B5.tmp

Filesize
160KB

MD5
7186ad693b8ad9444401bd9bcd2217c2

SHA1
5c28ca10a650f6026b0df4737078fa4197f3bac1

SHA256
9a71fa0cb44aa51412b16a0bf83a275977ba4e807d022f78364338b99b3a3eed

SHA512
135be0e6370fd057762c56149526f46bf6a62fb65ef5b3b26ae01fa07b4c4e37188e203bd3812f31e260ec5cccff5924633dd55ab17e9fa106479783c2fb212b

Download Submit