148172cb21f79815b72c4e9e25b3b17940263a0f62c467a4692bdf097f427a26

Analysis

max time kernel
142s
max time network
149s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
28/06/2024, 12:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

1a20986a0f440c83f6442c73a20ce575_JaffaCakes118.html
Size

5KB
MD5

1a20986a0f440c83f6442c73a20ce575
SHA1

21b58068a588842a611cb4092f1722236ea7c37d
SHA256

148172cb21f79815b72c4e9e25b3b17940263a0f62c467a4692bdf097f427a26
SHA512

7867574d0fcc18da523aca2a91af5f12d60d84884ecb97fc23a33497e240a5e818ef6fe433779d2ba56c1332ae9e4da29e97ffe208c49a2a2e24627ec46b4f10
SSDEEP

96:SYye/thlYjQgguuDStWLLTFBWLLTydPla7od0Z36:SEycuuDStWLLTFBWLLOPUkdX

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "425739872"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000005ec80cf279b2564c91633e21940a807600000000020000000000106600000001000020000000c947321c21ec9d912df0a63c10e890b5d493b5d198465c1199a3948961d0ff35000000000e8000000002000020000000159bd926c514cc00b7bf56f8c8f074b5ee40bd292a263d9d729ac304b57de5b590000000e9acf82f30d9038b3b9eb2d420b3e45cb7695e69d139165ec706f1e69f1ad92dd53de967512691daf3fa3a2fd962263ed3e0786367a623409e71684d801c0f18dd7cadda561410324e6c8de7f9055d79a70d0e46d164ce95531de0bf5c68eb623bafba3416fbab1b4300ccbb74c7847d3f0f871645c59b288bf7c7882ab2a8b6c98749f4135be39126aeedb2245ade33400000008dc09deb9d7c2adc716786ebb838d0a6bb7b082c08c26d309bff05c223f9158157ea0bc191b2ae78ee3e4899acb6ee6fa9a97dc91719611550954e41f7caf8f4	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{9C14DE01-354A-11EF-AF9B-7E1039193522} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000005ec80cf279b2564c91633e21940a80760000000002000000000010660000000100002000000095f26ef685425deac08bbce44a613d3adc6ddf196d4213cae9220081bd669772000000000e8000000002000020000000ed29d7a820c351e6e062eec6d56ece88dbc671fd62dc3c1959c22ce674be084a200000007ce8808eacef07840ae298ff037494a646729950a17c7e043b313b47a7c764384000000038ca64a234123ecbcc95fb08421637887633a60af73c6f7918c6f02ffe98e5c4d1a022c2523ebcfd56b5af0583f5d422017104d85bcd28afdbbaac2961eba168	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 90ec0a7157c9da01	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2012	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2012	iexplore.exe
2012	iexplore.exe
2936	IEXPLORE.EXE
2936	IEXPLORE.EXE
2936	IEXPLORE.EXE
2936	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2012 wrote to memory of 2936	2012	iexplore.exe	28
PID 2012 wrote to memory of 2936	2012	iexplore.exe	28
PID 2012 wrote to memory of 2936	2012	iexplore.exe	28
PID 2012 wrote to memory of 2936	2012	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\1a20986a0f440c83f6442c73a20ce575_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2012
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2012 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2936

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f81438486d4058481ad8a07c27cdab8a

SHA1
e11716eb2fa6cecf1343c44c605f66da0fac5b7d

SHA256
897c9ac91bd28a02b4f00a36d16cfa44be922a506ad499fdc862c4c6751ee629

SHA512
48e0dcc5ab6e0ca0de6e7af04b324b87f0d23196e57628f2a9f2e3dd9916190feec1e61632728c340b532081334323d60bf0b9b067847793be5d168195868d94

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4c4a09d54b01e8cc0286fe888f31277c

SHA1
e25e1d8822f61ba64b4e0daa1bd87dd7b2bc1922

SHA256
df746285d03c166d46d8c0bddb14e32d4c097bd00cef24b48a463928273515a1

SHA512
2a89482b8ed54aaea38561385960ca5aba65817001e77032a14a2ec86b1244affa7aa36c21e30bd77afe133c127e73abe98b044b0c82b185eef169a993923e77

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e8d0876c4da7508e7a93da75d53dfe5b

SHA1
9053b8219e9b3a6645f7f945929ac6fa13e80a86

SHA256
d323d59c60d252e2ba62775650640d17f56f95c0674cf1bd05cab176288dc3fd

SHA512
5c934ad6d68c78887fc1b9f2eccda89dec9339d0750a18085ab93b7812104deef9ab18fe0a01a98412ad17d314dfb44a8be6c8d2dbd0dc07d370e537dfbc5060

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
46e7bd1788c6cfe57249f18182644070

SHA1
803ab641e370871fcb24c786283f364fa2e9aaad

SHA256
5601d3ea7f6a28597125adbf0ea6b11df86ab75b401855960022fd916b62a7f1

SHA512
e4ca0ff76c3ca4b5f6ef74a271b60140c0e015e95ac5a36fab8ad9fc4f3db73e561a7919b9d4ac2ec9a84ccbc6c5c5f47cd1240501eab70db7a9258e266a2411

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
318a4ba01e12e7e6f99740224bb15aa3

SHA1
4ac3f05ea42c340624f91ef7b9ed7f89c9a19c01

SHA256
d7832ed8cd5fb01fa68c61084759bbcaeeef394ea3693042812fb944e5a08a67

SHA512
0346535687a68bd1cc6aff6c40141bb19926d2647c867f00ddcc7cb0df8e259f27141c660d4082ebbb1073f3a1ee6f4d48b1b132a5cd0463673eea8d80880d68

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d9193f0e79de27fc755b833236651358

SHA1
4ad23191455e410771dd30686010ef65bce19099

SHA256
58e4e024c84d1d6d1e7690c21999b558e1e857d46c3f676819ff9214b1dccecc

SHA512
c541236c2e3d86e08291e33ac7f1244b13a67083868b1cc044b02c28141628758a35c4d56f4dc5f0500d244062d5a0c7ec2da27bd0d02d19b6e7be83000fc6a9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e691891a55dcce295d15cc171e4e33e1

SHA1
104c6f7e35f503a26ac88b23122ff5ab5aa9529f

SHA256
c80e35117ca34f9874abac4a9cab230fce7d27aaa9e4dd959fe7423d674894f0

SHA512
4ba9643b303ed915577f60cb36417577b36e38dfeada9d3b462e67c8bc7d9ba03517b8fb199e83a3c8a2d7009ff5292831b30f2eb9f6fcc301857fbf81ee07a9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
70f03bcb2c02353d496645b8f1f119f0

SHA1
ef333fa3d20be430a370f933f63ffe1cc20bad06

SHA256
2f1548227da982012c71752faecb778d13915e96a0861546b5dc019899813421

SHA512
3f25c68afa1a71755f26bbbbc814aae0c1927f6eb3edce2f8e823f52462ce176ea07e589c06b292c22a43fa5bdfa8153ea5fd17956a73725f8e2a3d42a7db10d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0aa61a8ee9f19d243864393b18ff9d0e

SHA1
32a4fbcfda328c8e5647ca254c5e2adbaa43d59e

SHA256
c2a164843722a8b61f91951797ce1d48d55a78b44ffa7f2f717fb1d5c0e5a9ae

SHA512
b7002db1999e6e3be1d878539db400b158a794bf9318f865eeacdaeabbb11d0075a9bcbbd0af0e36162a811f882a138bb83b38b7dc97a876fde87ff58e35281a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0acea907f7d673e9e0a8f7bc82469232

SHA1
f575719aa2f0170585b9f4fc28c770648778fd75

SHA256
983a682182fdb5f5164c0c6398abf76f2e86ba2910f336adae1aca5d900d2390

SHA512
07933f2970e54c5c96ddef14c59b71151b0b813449e2a3034e7247a472c5a057f3626bd9ebf74f7a946f992fec090105a48f8ce5870411f0c01b9db798bae0d6

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab736D.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar748A.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit