4216aebaaf010365e2a325854bd2f0db6db61f1feb99ddea87c9f5d992ca18ce

Analysis

max time kernel
117s
max time network
127s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
27-06-2024 15:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

168d28f292f86f27926dac28f39a51ed_JaffaCakes118.html
Size

53KB
MD5

168d28f292f86f27926dac28f39a51ed
SHA1

d4e2e65cd69098cbb4379d2f1450b933d3cb9fe4
SHA256

4216aebaaf010365e2a325854bd2f0db6db61f1feb99ddea87c9f5d992ca18ce
SHA512

420760da8c949e9264bca72eea0381e87ec1d8ab4ab9fab89e410cd1a8d10e6254ef04ab40feba5ffb2c7a2cfc011f821d8f065062266ed683eb9bb622267473
SSDEEP

1536:CkgUiIakTqGivi+PyUYrunlYN63Nj+q5VyvR0w2AzTICbb0oW/t9M/dNwIUTDmDT:CkgUiIakTqGivi+PyUYrunlYN63Nj+qK

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bd2a7708e9798e4fa0b20f3efd8e9361000000000200000000001066000000010000200000000b214c885c1af520b7415503ad664b0c8ce70b59ea6a683a7258a71a7268fad2000000000e8000000002000020000000e020e0fe2218523f9c3b906651403fe51f7de2c27a7ef7994ab8dac15dbd5334900000004eb81bf0fd661cb2b393f2e92d2baacc553603c1dc2596e6ae0cba7a27d18c3d76d909e2a6273dc617f375ac0a72baa09200abae9edcd0aea57e4312e6b1bf4a4df4c8f845771f15628ebd19bc996228b1ec985e1f1e5b829b5c79a634afea8227a1689ce1f109d039356b285abcf5fb4b6ab72677e2f43b84f1a2015ef8ecae16ae41a44647debe85e0ceab87b7f5c240000000961ec4e9d826c58bc6f0a8c8d09520a177e2bc66ca3d43af6c25a4fa4f3ef2d25ca167efeebbc844b7ea30702280d3b05783c2a9c5cd6e5d12318e5472bde41a	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "425664543"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 60f75b0ea8c8da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{3906D111-349B-11EF-91D8-D6B84878A518} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bd2a7708e9798e4fa0b20f3efd8e93610000000002000000000010660000000100002000000044d680479211b726dc43b65652679bdad3390ee9ab0e1266e60e5d0b502c2311000000000e800000000200002000000085fbbebb1c81bf18a01b13a441191687e814c98f2448226bf07e5cbbf681e01720000000ca71abb029698d9e061fb4da81593530df5a3466685543562c1a69f0d754de4340000000873bc279c720ee2abd4e4a191cee3d7f1d51e1c96e92e485932845e92af3a9caf55a9502cf7fa947d9a768bfb60c26b7583204f1165d1b31c85cbc5fb34e89f1	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1792	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1792	iexplore.exe
1792	iexplore.exe
1228	IEXPLORE.EXE
1228	IEXPLORE.EXE
1228	IEXPLORE.EXE
1228	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1792 wrote to memory of 1228	1792	iexplore.exe	28
PID 1792 wrote to memory of 1228	1792	iexplore.exe	28
PID 1792 wrote to memory of 1228	1792	iexplore.exe	28
PID 1792 wrote to memory of 1228	1792	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\168d28f292f86f27926dac28f39a51ed_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1792
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1792 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1228

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
34a29bd1f0e6760b66723b20af74afbf

SHA1
c1f107469c377cd090d5709d3da3d85279a03c64

SHA256
8166828629e2f2b039800d01895b0610402db900561b7513e794ad524017a033

SHA512
9ff91a8842ec084b8e5ff724d8779251736aef15308d16599367a12015e46fa4bccb3353cbe2ee14a0265191900d6c8c9c89d0ac1a55a58ce95f102c315089cf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
8798356c0d7fa695e4889c37a7a723d2

SHA1
fb800fdbc0753eede9c80612c3b6dabfc0750f6b

SHA256
787dfdbc4c51c0571c42b961072ea26b169c9c48fb296198be53db282915fafa

SHA512
3f71a5c16a66d3efc8e6d9726d4fbad75612e84e601047b5ae18baf8034d5bd25fe5fe1653b859421dc5b13fa026bcd3a628774f406cc71751d90d17a1f4bd9d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
c8d2602abd5c61d331e39d397a554f9b

SHA1
bd459b079e1969a2f9b63e6b05963be9e4c8e853

SHA256
001dce61258d870569ab9d9505feaa0cb0a457222f25610e8b501537334b1de3

SHA512
15d3103fc21b43d712fb2a1a67012dced104cd6cebe018a99d48e79ec154d6ad588b047383b99b00decc7e2b762139d1b2ed1b433282f3bfef117a13479f63de

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
11ce0358a3584652b5347ff7d31de84f

SHA1
2ccb58853f34061fac5b0f0ef83453cc4a0e9b2a

SHA256
6a0315244cf0c307456356b98e364a69c8e97a63c3216688dfb0687555c7c2ad

SHA512
abb6ff4411b4abe89f4e9ac5f39fb7890ee8df10a2e77ddea3ce9194aa92bebeca381f2496400b512f0241adfc78480f6f4e1f91fc950a832a24934c2349da48

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
95f1e816f483520bf4ab71c6398d6f9b

SHA1
0090350bb52cadd293edc09a916bdf2fd137eecd

SHA256
c2d0869982d565714c485fc1ef721a0dd754a6850f62fad30495e900fbaced93

SHA512
068448c99570ba434f4e8315de7b4df49d979715d077f7ebefcdad6e114cc9011713d886e2f91195413d40993c072444eb3dc34aff66c87349c04da9fb134c3f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
c6218a2d02ec2fe51db922a44adfa5a2

SHA1
2f8e8add8dffe0ddfcb1b41fe29c1cecd1cd7669

SHA256
81585085592018052d3b4a3c81c40fc320c5f15a779f41dd8f3b825a7e9041b5

SHA512
f6e6c7561f25eae41b5b9bf44419736b6454316027998e63e37ef8e3da744657b61f5ba48bd437784803f420783dd88833c37b3b79a9032d6305125cf68f8dcf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
9851e3854b18ffe8d369773fae6df145

SHA1
19631ec51e8b588d691dc4601a383e9c552c4e1f

SHA256
556ba173610dda5b6ddd26b1ad0945e0e543eb64f33878aa5bb95a560e47d0a5

SHA512
1a23df5b38f36e85c1eb2d3033ba08f9bd7e6e5eee4a54eaa7286349b89c709903a3432e6accba230f935cb322ce82a7bab00974f17251b38012129c30e31132

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
7f92f745615f012c75a8789ad17eaa98

SHA1
18cf1a17bad1334ae7ba1a217914e23dde9d5574

SHA256
9f2085de6a88a791689be8f9a4ed154cdb66fa67382a18acb26852237b34ae27

SHA512
cacef978f35856dddf4a47cb91146de4d5b3cddb5450f1b5e3bbba964760774571b80a8a8e8c4f753ce0cefce9541bb498ed1ed1c80896672fafa215ccc1e522

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
c2f5e0ed96b21b809b62f5d3adef3ecc

SHA1
9a3ce163069dacf680c46505c4f3636b631b7fad

SHA256
5a4403ba1b1da22a3ed181f39dd4069f5324779f578e5fd0a65aacf153ab27e1

SHA512
dce72c85de2c97dd743af458e3037a599a3a7466bd2de41efdbe05c2b1c0f98fedfc9d7b75ed0d8be0a7c5c9917f9052a624276b3503823e380cf4c64d0c3ccd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
a0d3b885ff6f3ff1c7c5740ed5153509

SHA1
46d44169d117c78828317bd4e9ea7d4b0ee835a0

SHA256
9e19f5779304f286f26343353e6b1d479a1bfabe39ca7243b3c1b699e12aea20

SHA512
f9a926c3c28e7b0a5527138339b209c32440ee56b7e4f3c0590733fd863f91c596cead04d74eeec115522a93714995d59c2ad200867005d57ff21a2c7c8516f1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
b572590133a12213145ef0752e5fd20b

SHA1
5c0ee991c6496335743f6c7260882c7109a47688

SHA256
f2e9efc41c936fa046cf8c0f178b88951da133ebcd760b4f7118ecb9f05575b1

SHA512
ee6cb3dc751fe7a640fb2cc72e4e2080a1fe0ae220af6cee1b8c6f10ea9db099cc668c32d4453753d98b2a43284ee8c01ec0a988e6126c278e9e44cc699c30f6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
38deaeb4ff46c459e7ed915bf83d1518

SHA1
a1337bd30d42d6e9b2d80a5b0509526e8c884004

SHA256
a542f4b3f9962a52fce3afeb8f54cd9502e485c2849300ea342d5df01cb455f5

SHA512
ba81138f9bea44953b7a3b88b9cf07a2622246a655a64173d1c1e50a60f15f34e87d1db0fa76a48c6d94540c9d02cab268e91e5148d2c15c1da26a37a53dc71b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
86e34c17726860ee97d95f50c19deb90

SHA1
e4cc10d753fa9e1ffff400dbc298c679209620c1

SHA256
56bf7c48c144f1b2a9f9fcc6041d6845288d9aa98eeae9f285f9bc027f4d5816

SHA512
e67a5717f2132ec8ff212aead70bd7bbb462c79de19bf542335d0569bac8a1d429ff00dc300e6a8ed14ec4b60cfa6ad6fe50a6fbd6e0b5f1056f6e2e8828fde1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\TTL9DZJ3\glossar-js[1].htm

Filesize
706B

MD5
67f3a5933c17b3ab044826d3927d0ba9

SHA1
5957076d09bacaa6db8ddc832b4fd87ed8f05f8a

SHA256
97e800f4836b7030dd58fe6296294b7ff5ef1b5eb0e88353f230ea1608d2bb64

SHA512
03ba224055ffdbf32b7eea30c764dc18d66cc6d8707dc5fafab74e155b0bb3d4d691c5788b033a68f05299547297125122778fa7e3252f93e7343d918936643e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab315F.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar3212.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit