14a0002dafdff323b86d366db62add7249e36d30d8da485b63400de935345a8b

Analysis

max time kernel
121s
max time network
141s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
27/06/2024, 23:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

17db12217f926d00b9d49cb0ee43cf7c_JaffaCakes118.html
Size

27KB
MD5

17db12217f926d00b9d49cb0ee43cf7c
SHA1

a2188855166ce125826be8e654a5eb32aef03b77
SHA256

14a0002dafdff323b86d366db62add7249e36d30d8da485b63400de935345a8b
SHA512

3c23f6c0f4792980281fed01468946b86aa095e65bff6dad5bbb1e5242e236109dc05c4a6961e3e09000ed67556de8edbf5fa2c89375508928261adbb1bce0b7
SSDEEP

384:x53H8mf53H8mf53H8mKZfQtNVQjvPtXwiwXwTTZ:x538W538W538lqjQjvPBwiwXwT9

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d7c7e73b934388418857a0db8be9c1d100000000020000000000106600000001000020000000fa0880090eb1bb66dfa5e8b0842216c160c645bdd7edeab3b6899ab9db8632f6000000000e800000000200002000000056b949d550c27b251beab2a72b2f3f9df9ab6cd7a161eeaba2e153b4caac0e59200000004e83aa46a12c7c3d09c9609878213402d90476124b7a4657a5e5a78baf9db2e0400000001b53c0936da0ada3195696cea42c73b3a2368140462b530eaa27a95668b3c857fedf8be80d7269e55823873e1eace7104f18f36134d4b8e4cb422dab6b50c851	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{8C4EA571-34DA-11EF-AD38-76E827BE66E5} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 702c9163e7c8da01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "425691754"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d7c7e73b934388418857a0db8be9c1d1000000000200000000001066000000010000200000007771197382ddd9cc34b93b4068cfda5c480b71e4fb24d7af6868e36b917b9558000000000e8000000002000020000000d85d1a52ed05e4e333bb98dda10cb4debb25817ab18d76498f8e6fc42706361a90000000f3428ef2205a3d4458affad9acbdf9fa951c8a9bdf02837e45611a27ee6e1fe094275f3385b67347d3a820f0c37373f6f8017ae2b5cb225a9dde8fd8279322b6d149795829e5395465613d4606e5aa81a3f5d8931dc82cdb4d444a6b021546af670e2251181ff83a3cb1972f4651ad29deb669873a83c9da24dfdbd64c14d97deb5924271558a32dd89a432dd73fc42c400000009a39a7283a79550152e5cc6fd5a43acbf93a6b9b2fc3bff9118533850eb4f15d1ea9b5ac2c3390f6929b95323b84c3b1519a4dcb254c66a40d597966a82b1894	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1860	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1860	iexplore.exe
1860	iexplore.exe
1636	IEXPLORE.EXE
1636	IEXPLORE.EXE
1636	IEXPLORE.EXE
1636	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1860 wrote to memory of 1636	1860	iexplore.exe	28
PID 1860 wrote to memory of 1636	1860	iexplore.exe	28
PID 1860 wrote to memory of 1636	1860	iexplore.exe	28
PID 1860 wrote to memory of 1636	1860	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\17db12217f926d00b9d49cb0ee43cf7c_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1860
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1860 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1636

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9f20e07cfeed5faf3979668bff82b005

SHA1
8038049b580a670d8ebbec92cbb59797186b7f0c

SHA256
c9f7767db6bd3f5ebf752f0244143e4c0f96eab45b0c582b8692bdcc0789997b

SHA512
28582a37d63fa7a9994d4c18ad6824db5996c43efd433ff31ee24d1f2b6d5bf809e6d529ccc8253d7c8a2f0cb234e20806cffa47f751746f9b3943b25ebfcc89

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d7c9aae6052ac08e0387b20d04e7121a

SHA1
69fff898e9774f81188b6958cce6cc82498d34f5

SHA256
61da36bd8f195975a1073ba19b8fc322049f5aff3ab2c15c46f5cb890f0c6536

SHA512
41455dedab5a531fbf59939214ed6900923d350eb0981c3d9a31682720a67a567e96160ddabf5d579535d80ac680d4fdeb3bc6257cfdd94bf7a305ae5af96e4c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4f4399590af2b143871204623a3324f9

SHA1
54f44000a6058b0c82dff2a35ce8d0cbee64f87e

SHA256
931cf222ab1465156368edc92eaa381b24fa245dd14500f090c2d0c875c209c6

SHA512
e108219c12edbf6b005305d5ef2803adc7b22f46e13cef8526897654ef81d31f9f5d92f9d3d1fceb7f848724e936667665f06fd00c6cc711e45ed9404b6d7219

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6014f161582c434959a3c1da3cd6d525

SHA1
9968ad96db44616afa21445df2a146de87d8c2f0

SHA256
f4322699d0f5b1105e9c140aaa72d3e71ca34f7864d536bc8c4e134a63065220

SHA512
8ffd4f5dacfeb07d6a83d622bb73a12a5d4350ec21d83ee29bd826ebce511f1cef9a2028e76a0be28b962fcd95380d21815574d984183c0af9ac6e749272b531

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
bc36513dff759841af4ad1851585d5a4

SHA1
f3556cfb21a8ce5d5add64c13b93ee13f5b7e6d7

SHA256
7fc0ec54e2c0ebf50401064e59eabd72962eec1f1442ac1cd2ef0be5e2ba6847

SHA512
47ff3eb10cdab3711e45c0649da7989787ce8df21e6009bf411c28c52d030a6d1d1c35840bb945f095249da4a2c92a4ccaef02808a54facb7a2c193abaa8deea

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
fb59a90e71a61a27b7719234b8aef7d2

SHA1
050ef7d0a34f7e5818ccc52001a3bd261ae4da0f

SHA256
b54a0bbef39cff64a9e9e8c21f70b1088b0b22345481611c9a60db227b481ac5

SHA512
d43c80227a30d74062a056cde233168d91b0feaade7041516d9d7f012d51e89ff5ea52eee28ca13317b30ff776c81f3c925a983b576cbf404b389ef2384ad83d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
58615853df73517b9e1d0b8499897a46

SHA1
2b01c00f06032fe9cc446e11b17499ec00ac0844

SHA256
c43c56958f744548cf8aa63683508c1e730dff595ed499225febcb5871bd51cf

SHA512
7d827d9db3b70f524ff7bcda1e27d25b84f6ae0c846186890b8f791018370475deadb4402390aa208cbe4adcf8a0eb9491b7c36d1aeddc4315e4c2c03100203a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
eaf0ccb01447ed41dfd0fc18d46e3248

SHA1
f1d71ff0784586e2e4c7fae056186d2033816ba0

SHA256
6228e69292e2353d221848bf6be4e037e04e13a757fe59b854bed20d24c70534

SHA512
2049fe2f7121f6c76571e858727c2fa818a6758bf5ef4e8ac5d7c456ead0f8aadae9d2577df9597dc37c74eaf96b1d72062a276d8937a4f3276b229e82efae3b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
cda701350952f569865f41c1d49095f9

SHA1
b94e988b4523fd207ab9d0d7c3ae15bbfd74762f

SHA256
9a1110b9015f2bde3f1902f44c1a167e39ceee02d5200651dd19add21bcc3947

SHA512
9b9a1ca1aef4ca6c46c4f32030bac8796fd32f75edc11d6dae06f8fd8633d97809877886a8771eab32acd7295c75a4793082d5c0e7ce987b567dc4820cc39e75

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4df56ba6deffed90ffb8cdd9c5ea95a8

SHA1
fc9050ac692b6227b7dcb00833ed15f953d160fe

SHA256
829d8a866af8a735af5a3d43a24c8bfed69d34e821d94e6e89c957f41d459c0d

SHA512
e8fae6f202a55aaa0bab05c946458a7e79373405394358fd7728a79c80c7b54c5d936c6d6ff4282c2c3383ac634b49fd674506ee03ac1add7c8743a28d68baae

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
cd763e5e681f9847401524b49212486c

SHA1
d50b82c0944b0dfdabc444fbba777c009a1758d4

SHA256
9c62776f3874fa9a57a8987bce201f60dfa64981b136bf349ce4868f08c4d1f3

SHA512
f8e70953c33728c3a68ce9465b0c8d88bcc3f29aa91e58f18b079603406760aca43fae5c6f26930c5c0b5bdaa41ca7f761df478264e48c1d0f69f29d1e3786c1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b2e5d46afde83aa044179b8f6f6e8f3e

SHA1
d4d50c06cabda34b630f451906b344fa583ffd89

SHA256
8c03339d90279955368dc28c477fc682f6acbd62bf58421eb27558d44cd70c2b

SHA512
10ffbde842e645171f8752be920f2b0d4dacc2609376c5d8d0b2b10494a2526cd656abf124f4a9691960b65bbba61e518cf1b1bb9d18f576acf66d51504f62d9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ecb5e53cd225d7c2adc501d9b9df24d6

SHA1
4d23ad98cf5739dfe1e5c4c1af23d3afda04b5c3

SHA256
55134a77ceca672e7c4f30b6204c1cee94bd779d37545220f530220962a4f5f5

SHA512
f4c16606aad293cd3940e7bf43039585cc94aafd187c989643c09bd407ed25b736013b83fd5c4d61900b28f5b5fdb46dec76315db02a783161e59d4c98b303e8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e87a5e97664557f98c878f098f871ebc

SHA1
45f5cf314fadba0eaaf85aa3e2ae85cd91c3fa04

SHA256
811295eff98dd32bf83b369879d534796ffae95870f7cbe505f96ec4f2a4dfb5

SHA512
b0f5f5c643ec009f664174815b339f95b4632ec8a26a34b2b51e9bfe38bd70a40933e30bd3b3089703035f176f5cd7b58b129bfc10a3bcdf699e1e5233d8032c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar5411.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit