5b520a30a8571a03a018a088ca0be7f2806052631e9b7b12a981ec34cab8b198

Analysis

max time kernel
119s
max time network
146s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
07/07/2024, 11:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

29f60b220545b283639ee97221d71adf_JaffaCakes118.html
Size

15KB
MD5

29f60b220545b283639ee97221d71adf
SHA1

2bd9b798f9c7f4c46296f87695f6d59085f5d28c
SHA256

5b520a30a8571a03a018a088ca0be7f2806052631e9b7b12a981ec34cab8b198
SHA512

029ff7a430890a080de1446909f60143ef6c85016be979eef497bce2ce87571cb3388263c78b769cda8c8f42f96fdb8f76482baddf1429f60e1cdb5222bcea7c
SSDEEP

192:JuU5tMes3Zd6S7ns7g72w6+g+zBv1B/mCLzNDnq+UihzzUNF1dt6TExyykIOzZfi:0DsMSOcP8T6

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{50EB7A91-3C95-11EF-9CED-F296DB73ED53} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000000d854e951ecdca4792ad3aea80f03551000000000200000000001066000000010000200000005841d4bdc574d3b9e5ffc9f9d845ac3bbc8dc0f9cdfb55dfec684ef241791c62000000000e80000000020000200000001b4ed7e97fd04178fef0ddf734f743d1e3e0a3db10901fc0301da7718d4be5ea900000006990ffd8e1b223c0e1f2223bc396896a95edeb43e89b27bae83206b710a4a07e297686e467c3f3efbd26d1480164aa819b415490af57544fa31d552a54e160cd90f66392e5652afbde7500d14efe47f442068a0d3fe82a05c3eefc2bcd9d106efbbc9f4f3db8c759f063992fb7a89fceb0aab7fa4baa94eb095281dfdcfcdad5f2f74ea5bd8ed04737a1295611f89b964000000047df98f6a5ed4ff21658c674d0328bac8b88a357e37185230ff58926349ace920e0a5546f474157d803a48201bcae39047dbc0ede4550b03701c6d260eef22de	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 40349425a2d0da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000000d854e951ecdca4792ad3aea80f0355100000000020000000000106600000001000020000000197aca2b07af97fbc52e30db3703057f37c8b7baaa390d28871482f529cf4f34000000000e800000000200002000000031d4c0b2881ec04282544d62fd1ae4921d7f0b8b0cd7782df3346b28e972855e200000001cee3a594aa0d82d329643c54e3fa25256cbc784443419e3c5cf1ae3977e860b400000000e18639ccd74ddc47de98900bac29d0db7f286d3c55734d4105ee1d5f2d8089c7fd4867c8537039cded121d2ed8fdece33e19bd2ffdbd094b17da92ea82d3513	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "426541628"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1644	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1644	iexplore.exe
1644	iexplore.exe
2504	IEXPLORE.EXE
2504	IEXPLORE.EXE
2504	IEXPLORE.EXE
2504	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1644 wrote to memory of 2504	1644	iexplore.exe	30
PID 1644 wrote to memory of 2504	1644	iexplore.exe	30
PID 1644 wrote to memory of 2504	1644	iexplore.exe	30
PID 1644 wrote to memory of 2504	1644	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\29f60b220545b283639ee97221d71adf_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1644
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1644 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2504

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
65f50e9c5ec958ee34da369442361690

SHA1
92a014796562c082c964d4c2d00c975c323f97dc

SHA256
e8c678295ec57f09db5de007da71419f54fa178cd03eeab6df1d931692d4f905

SHA512
fb3a60ce568ada6b4a0b36ce045255fe07fa19b2f7d07b39fde6a63512909271d6b0dcdf66483a947f1acb2a8dd3b207584f4a3523fc43ddc084fa6b595cafe7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
619f1c3f9d16645a9de37105a2a33b8a

SHA1
67de66f084364e29ee69fb4b9e90998193217edf

SHA256
5c212cf3aa8cdaca133a7ef80d883313ac2e9e50daa6e226483271cd50222019

SHA512
3cc6bd7abb08ae2173ab4b28bbf6c5b4c1d4b65f5d2e33ab8952e5981827a87b16da47806884e21599546b2343c464d29c4597b6c47020d41af3781dfbb17959

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f3f4ec8e163d6f157578bd85901981d7

SHA1
ee93a2b1323c00eb08555266cc155f1fe33ad073

SHA256
3fcbc90cc620c25c05e4a46b9c99bab260b5f741ef31eec192e8c9909dbc7948

SHA512
97a1dcc3b8c6aed8f7a2204a9c7ca9614cd1629ee5ffa34da0e153f0d5528128dcd11421e4d197637111eabbe739c86ace788212caeb868e6c60344191c7cffe

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6e337b4e49ca48d3b67e5fb4dfb5fe05

SHA1
d012132dd64d2683cebe0b666393a3e0bc22366f

SHA256
c9ed4e94ebac03e9c43f53176319f15244f90a4e0b89b31046736b5c77fbdc90

SHA512
dc547976d01a42be116290855f69ddfcd623346471da395b9b24e9c83037ee6721cb6c0f9b90310d42a42222e35e6c47ad204c76e429a35003da079e292542fd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
efd380af9c0aee60907b87bdafb71f0b

SHA1
c7cc20daea7ba63d588d24115e082b33ecc135cf

SHA256
4db984470f48e234fc0f98db4dff890230de1e065ea86af61c49cf943b62eac2

SHA512
2cf63a7baa40abdaa2ac0b895148589b5bf1f50ba7555df31b2da45b62dcbc5b220fea57af26d34b7fd375da8d72182652557ca249a1d4fc8991ad0873becc8f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a560dd354cbd5557145895c6da73eee1

SHA1
707a8a89a4ceb47eb5d02139c67dcba14fa993b1

SHA256
be737ff635a376a424f15dcb6335c5c49af5dd8f55eb61220861d1e340840964

SHA512
51ec427e7464bcde580d457e6c23a138eba6c97016b7720ea5c2d077131c3732869aa8f9337b16af14699a8be68bb89220efe184e2d6b6e759e6cbd648201521

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
91a105dd2cd1adab9dbbb80bdc8fdf65

SHA1
685df05704bc87f3180ae25a12df79b7a9d5a347

SHA256
40b215657ddbdf2b6553f0ca4adc5c227ca2c09521d4f3f26b7b64dac4055639

SHA512
3f7e8ddf592bae9f89eb68f4f9c22619b356fe14d95a71522b3734b7786059437faca532acf79a3327bae19f3aebcc628e14317c0f3e0e91cc0ca06f296a0ad9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
fdde4e6d4305065a56c08addae2ba4b9

SHA1
3a65820d76851518449952355e7e690f9f2c13f4

SHA256
beb642105431be67d378e80f4a6e820b3bb353bb33a8c4e2613ad30a1ace2eb5

SHA512
8aa1c2e76d6f8d928a4129f38a5b0fea7ed7014aadc5d15e83c46993372805a70bd563aa71f90825308e3629887e14bc8d4e280f653c48499023a20f8929a3c5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
667f0fd91d383af9c6966a5870b1be84

SHA1
ab9387fae1677198cb76e88a6a1452c1e0f1825a

SHA256
ed8e147e4f6ebc994f779a5c45510299c02e52a355fa462a51239f0332218476

SHA512
b131cb04bc4f458d780a84fa2595d0021309f8b1f42a989b6e371296a609cda5c353d2dc9a74dc7f6ab1747adb7ebd441f4a556bc57c6125b672143e4b4957ec

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
30ed0b8c18ba50a56971c9b78cdc215d

SHA1
419624c7ef1e75493be35989cd53610abda799f2

SHA256
70714932f6c8341d28c382ddfa15c50cb8c6a8f3c2c3a26e5018059856a30486

SHA512
d1f41613c3eed2ca234ca1faa8e573b268850ab82585ff5bbd1b6bbc0e3ebfe58157d089452fa5cb2592c8496cbdffd9b836bc7f298fcb3620ab4fb5f23b502b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
31ed07085bcc156be950faf0d9b7a4b6

SHA1
87eba96e068d8663efb2bbd03eb8e3d2da70c03e

SHA256
6f193e586fa2903e4342eed1759ded3981b155df14226b2dc2c12e093bb747ec

SHA512
376d59573dabe371d382039568a3f79a8589e907ee4fa9a294918cf0f9d4fb7184e5e8d6b4286d4df7a78183ef8538a33a960527ac1f9475780e9ad2ddf38544

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
81a7fbfa4afbe17ec59f1d414ec3259a

SHA1
34ee4a220fa2d4a5e1a3873feb3f2fb11d6c2c2f

SHA256
125b62dc1f6482951d61a3289655a63031f55678f42ae2d93a8cc3d817191eef

SHA512
275baf5b96c62c5b3e3a57463c75aa7bab656f75c98a6f0cfa883bc6d6046af0576c7cb415f2b37900066bf7ce3026a5bfbc8dc2db34a84a9a912f85eb96fee0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f6c97b090633d49254b13412edbc394b

SHA1
e5d5b968aedcc9cde90fe75cf3f596c9e82c9da9

SHA256
28c3cac975faa12b39262ec3113a72d1b79ca49d3132504e578a55520e251aa5

SHA512
b5cb944d26211aa0b6105eba5bf56318b9d0ffd52160fc9278692551164b837c367f039821577b8a5d917d56862d6fa85b9b8bd38667104526e9e37ce7b892ed

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c1f844e85792cf77569b471e0a69ff9d

SHA1
dd205bfccd66afdb7f12f33419a593c8ca4a708c

SHA256
9e25c3ae9d2be3c0e4b377c964c0dda38d301d21a2fad0d28d1620771fafb3b3

SHA512
d707c1cefcd574cc250062883c14d6c9df79e13052b73f001e4275642611b7a6dc14c54f38f2bab3e82fd1a4faf2814b4c7265f77b69556ab4f16672e2a44a98

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabE6B9.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarE778.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit