8cac2c82b0150a56f7ac9882f8e54815d126eb8acd9fd52dcae98edc0ae53d8c

Analysis

max time kernel
134s
max time network
127s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
27/06/2024, 19:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

17385e56a4e86c95839658d94c7079bc_JaffaCakes118.html
Size

7KB
MD5

17385e56a4e86c95839658d94c7079bc
SHA1

15be98d7d641262dd71b92d67fe46e8c1289e8cc
SHA256

8cac2c82b0150a56f7ac9882f8e54815d126eb8acd9fd52dcae98edc0ae53d8c
SHA512

c198f2d21523549efdc9275a5bc592a7097414f2d3bc627198c7a1eb4fd4f0c1c00e60a2c2660317013a5aaab10d4b27cd263fa7406dd9732d0e4cd310992a08
SSDEEP

96:uzVs+ux76H6LLY1k9o84d12ef7CSTUyzfCwdxCDdCCpdACcdScEZ7ru7f:csz76H6AYS/GOQZ/jZaSb76f

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000000b2968c6cf60b74b94229c882944fb8100000000020000000000106600000001000020000000cd98afe2742b581bf32769317ba3e4919197d8e8b19bc4aff194ce56777c1161000000000e8000000002000020000000bd55a2ca4950ba6339237664e08e12189cd1ec0904b18b951d4fc5dfd3dec34f20000000e36f7682d86f9332216e9ad69a57d74aba44ad152b6faeae87ace387e7f4526f4000000004cb9c1b6612f05d964c16b38b6351cbc6c0d92d5abbd3cce3c44862127dba1f63a969984dfa748a272f65783277fd737a7b040c04183b44c8696508e7b4a2fa	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{3C5FA7F1-34BA-11EF-90EB-D671A15513D2} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 904ed511c7c8da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000000b2968c6cf60b74b94229c882944fb810000000002000000000010660000000100002000000045d170ae49259597ff94655b78af6a7feb5aca3fa54d4f6d066837d32738e113000000000e8000000002000020000000d27daddb11955d31d5d710fd756820daae0d2f8ff6ea453cdcb0e4e2c1d5728c90000000f567e22b986ce70bf0fee6d1a385da2ddd2759ac0f1c644f5a6f7355aac1e8c5986e279cea54c4ab0841ad4e87ccff1d49d34bd70164d55eed98ac8feb90e54eee0e90b3318ef621a560e48c13e4b5bb32d691747096f162507003881a021a0302d4485d10fd05dab35d019f187e5afac0ac6e540f3a6c2eacc7115c79addc25fb1f4c2c1bffc7bb8f65c97b184023c9400000003a4987014c9b97c109a450e23eebe4f31e3b6ec448f7cadf4a8beff8087a2a01fe8f45253aeabd56ce3247f5cdc236b1755ad4ca36579df7907de2f732927490	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "425677863"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2280	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2280	iexplore.exe
2280	iexplore.exe
2276	IEXPLORE.EXE
2276	IEXPLORE.EXE
2276	IEXPLORE.EXE
2276	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2280 wrote to memory of 2276	2280	iexplore.exe	28
PID 2280 wrote to memory of 2276	2280	iexplore.exe	28
PID 2280 wrote to memory of 2276	2280	iexplore.exe	28
PID 2280 wrote to memory of 2276	2280	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\17385e56a4e86c95839658d94c7079bc_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2280
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2280 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2276

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b8755c1f91dd4d72457ade1c00cdc62d

SHA1
674193451c14ec1845443152f749647ac5435f16

SHA256
2f934ee0ca25b9df243bab8c5f8238f012ebf3d4435fce8a2e26a42bcbf0b831

SHA512
3a47591e638fdd99f3aec826a3005ad4cb685fcab80cda39c5cd7e3622eef42f683b533a269761372d858478378029a8581cf8ad4412699d91e00b83347d2ad9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ee391d1cbcf5bd44a4a2879988522645

SHA1
fe01d95dcedf4d26a9a0331b6a460c06b62663fe

SHA256
0ea1c1680704010377b7376104565b2184020f2002478ae8d8b6ed2859a5b8a6

SHA512
e07b7a8a4b1994650314eeb1e4746f375f1fb3d91e1faef05dee90a0ff8eab0ca0fe166ef9a28e1ffdfc51b3dcb98ab9d787e85b16667ad4ac19d90578917145

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
28d00520a11d6d9844d47a47fb13cade

SHA1
55b2e4ad8b0efdb2ee6714310f516aea27cb9fec

SHA256
05132395e967782864f000e4b1e057a4019391fda7366299421b17d5c166d2f4

SHA512
334acd3f4386b28d1b9d633dd8642d9a0a4657fcaff33fdea094db15b60c10e6801e3d71595a965877eb33fa4cbe9c59bdec117bbd583c12d2cd67615a45feef

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
42ee14a661c8afde62d88461fc8a0fc2

SHA1
bf70a2ac212d92cbaedf88d1292984b5fe5dca14

SHA256
01ba94f7c8b79e47889cf3b769cbffd51c4d1f99bb7e1ccb5651a357f505ec91

SHA512
817528b22925ab572b92a2ee4309cff3cbb0d93be2346339170eae1df8cd9d4f1037728307b91bd3729995b37517bae5fe1fe7a84766e198f0e5d022eff00e4c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
bc1185960275acc151e675f97cdecac9

SHA1
ffc92687594f04f07c6e00f8f8b64a77519a5b54

SHA256
4ac80f97fd1d185e66dbcc7e5e73037fd697e9ca29edf735657985bdc019c650

SHA512
7ee52ea240a64b4dbc86996d2f09fd8b2bd360ed414a10c71b09b201cea3acb71c31bc9f477ba58f9bae34aeb68366d46beddf86c77b6a2378856ac4aed377cb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
808c67329526ae8dec26b6f0dd70c5af

SHA1
aede90d6c1cdba33ce50276fa17095c4fb729e4b

SHA256
7754bf5c2f2a686721eb4c9539b8410e1e4e31f1162ea22331429d4a604d04ea

SHA512
57e1f4738e89fc8bbbab81383932f18e7e82b0358f7bf42d7d3a4bf0fda55190ea413984ccfbaca2fea5963975af8b404b3647ced840526e4f3e2a59da85255d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6577300e696b4140fa3d2959d62e3752

SHA1
3c3076c918ff69779c1787028d6d4419459dab1f

SHA256
1fc74d337c11b510413d66881a3d253aa49d869ef6de9fa5ff8a06973a3f59c9

SHA512
4fb2fbc16af5381f67e4f39711e198c0d574d0047cd867427b9656f62610bfb56d8f3e7653be649dd1d58f0e04b1987b21a76f2cbd396bbc796f127e0ddc4b6f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6c47e23cced0a48df2f226fbef1f1a0d

SHA1
7b6f07369d5e978e0cbe59c12a9ebc44f972f4ce

SHA256
301c619d36d4746fcd85ab03105cf86dfda2a5af3d008da19cfb3536926350bc

SHA512
0d6d26ad7dc3623fad384e393feecc92d99b670abc9cced54ae5070a3a070be508920a86cb6372bb207619221a330d550255660fb2f6061678af431c77bea36c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e8e2e4d4127c5a512d5aae7df7e85b41

SHA1
29f74f9418f11972e0b87ec90db4cff91a70b5e0

SHA256
3958ae43b389abe33b6cbf96ca07a924ae6d87d05113ed60c93babcbf3f824f0

SHA512
e8b17acbc9b816adeda3c261d16dafe46144c74ebf9921f7cf032ea54e5aefeb650dce074b011f6e621e3b2e3281844d42ae64f90081f569c00eb58050ea3568

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
91a923f50e983d5c5e271b59ba9e4926

SHA1
73939d0025f6e0c4508e91c66fbdf807bb11483c

SHA256
73b1bfa39b9b90159f3db9f6bea7b9112209ebd5377f0916c5a1f4c8af1de779

SHA512
d243877d2bf20983e37bf2e7db77200e08362a905ded9f84796609c77d706417e24baf55f055e5d4a128c3ac50b05cfa434bc9602c7a38a172549c5fe2642d53

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f3080ef5978846172ee137d57460b929

SHA1
23e37e432b1366b44d21b1686456f5db0f48d1ba

SHA256
a691839b30da4687c3ae17b30085b9ab2543af83ebe582c3b9c9e37e1d7592e5

SHA512
f7d5b79eb26235cda19205df1620d9f9ae018d8bae8df956459cb702df9e0a00ca49e099d2f86110bb683e65a96b77c18152773c7522c089eacb7e3074205155

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1e5265b7dbe889d4b8ad835822348b52

SHA1
a72a7cc3e9bbd0f820c9f1e98eeec82a91a6d5cf

SHA256
dbe1d8195dff7302b414f80ba3e4d38ada0a25da785b7a06763b78bf65549acc

SHA512
a22f9f5ea302600c0b220b9bd081fc9bf549dffdcfda460d252f1706c55614cabe8dbdef4b7f1d8f80d1d13f33353eb7252a2fe8c6a1a2a7de2abe6094e957a0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
32a60e60db58c8df8c23e11a38e8f637

SHA1
3df410b2684ae92e98d598ca1268d50bd8b0e1dc

SHA256
f315fa31ede812b852087497a3aca105417f8e2afa5bedff3db2ac7620863942

SHA512
13609e074436c9536a27bf645957dc9af435cab9a2eeec4380472a04cf9f526e750f16cfb298aae23a9a664e5a9edd62953f620ac19f23f660609e066fe0ebf7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a87d5f55562b907a80b0e6222fc8c52e

SHA1
3e91eb369794f6443a242c595ed11a62bea578f6

SHA256
d34e6564ea3b913f9d2e806d8a535312c13149650290686b2dd5171ca33a018e

SHA512
7e401b04ff580a6706f5c2db4cb8f034894f9b840d270e664d6c5b2590baa1dbc6ffc8d00b0396386b21187b7de6a1143a7ccabd7799d492d3ae7ca30120847a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
fa28fe60b146d4fc16a1b8492b83183f

SHA1
72ebea78a7f0d8c1da6bedcd9d11d7da4293190b

SHA256
c75d0ecee3e1da07e75ce82d4d382d330aef6759e31908a492ac7cd6fd64c85c

SHA512
78233d7d3daf6894b25fe508f86a55ffdda4fb85eee33c6907764a88508183967dc29ef4b69bc2cadc5d11b7d38588103443b65d1284d9c4412a138bbcd88df2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
de3c1c3816b59170c97d4fba032cb712

SHA1
cd6b8458ef17b63b73132f452f277252f5c3b858

SHA256
cf58fd95813deefcd8c76d68f915499d841e95ad3ea8251548cec202202c4078

SHA512
7f90bfba1293f43bf49cb5f0813cb3f44f6f9dee61dd05bc96a736972e5a701990b6c96aa03f05a915d5c6a328fcb9a42ea259339a012e6efa2eb307f611d604

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab2E54.tmp

Filesize
67KB

MD5
2d3dcf90f6c99f47e7593ea250c9e749

SHA1
51be82be4a272669983313565b4940d4b1385237

SHA256
8714e7be9f9b6de26673d9d09bd4c9f41b1b27ae10b1d56a7ad83abd7430ebd4

SHA512
9c11dd7d448ffebe2167acde37be77d42175edacf5aaf6fb31d3bdfe6bb1f63f5fdbc9a0a2125ed9d5ce0529b6b548818c8021532e1ea6b324717cc9bec0aaa5

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar2F64.tmp

Filesize
160KB

MD5
7186ad693b8ad9444401bd9bcd2217c2

SHA1
5c28ca10a650f6026b0df4737078fa4197f3bac1

SHA256
9a71fa0cb44aa51412b16a0bf83a275977ba4e807d022f78364338b99b3a3eed

SHA512
135be0e6370fd057762c56149526f46bf6a62fb65ef5b3b26ae01fa07b4c4e37188e203bd3812f31e260ec5cccff5924633dd55ab17e9fa106479783c2fb212b

Download Submit