fa60cf4778e0cfeb4e7fc422864216b3a32554a68dfe0cae7ff7de0a27c00bc5

Analysis

max time kernel
68s
max time network
134s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
09/07/2024, 13:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

307a7a22f3d106c2761691d0a102080b_JaffaCakes118.html
Size

41KB
MD5

307a7a22f3d106c2761691d0a102080b
SHA1

e4838ca28a32a48bb8569448f296a5269494ae7b
SHA256

fa60cf4778e0cfeb4e7fc422864216b3a32554a68dfe0cae7ff7de0a27c00bc5
SHA512

a2d1cc3601869c9fc625f2d18037868df4c8827c667d9f4fb07e81591b2484d2d75e9fafcb383848ab4e69e27fdd52b45667c4ce74692a8b392a0bd738bd8adc
SSDEEP

768:P665fIFnHIa/Jzp+BeL1qhkl2E/x5SGMMSTCg/aSaZdUSDFivN5YNXmxsJk/cbj:+bzp+BeLh3bj

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bb7c5835718279428690b074aa627b7000000000020000000000106600000001000020000000d4364d7f75d5c3cea262c9faa24840e3d6d0e2f518b3bf8e3492f6e17a53724d000000000e800000000200002000000095fb7531d6a551e4a954dc0d69d512658d1da49a66726f39f3eea41fe965170020000000c0bb3986ce3b199fd9dec357d600e883d2fefc9f64e94e55daa1fb0a2b1f7d2f40000000a253b98fb1833c48cc44099b551bc4ba9f2667f1c81e7ead8565cef9b5dfa3a2295c4b37b5a70bcd2192e692d572bf4910adb2276888cbf5a8e04793a96a259c	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 1015adb00ad2da01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{DA1E1701-3DFD-11EF-BEE2-725FF0DF1EEB} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bb7c5835718279428690b074aa627b70000000000200000000001066000000010000200000009b4ac7f7205e1c905d256cf384a86c8f88ca7b9fb09fd6e937739be40ca5f01c000000000e80000000020000200000002482288cc06c4b9f710e5d3d90b3d04f54a0bff0b8c4785bc54b3f609ae2618d900000008765514a28406bb3f273bbb8b645545be14f1f4b5cc63d97173d0e5b0afa226fa8ded7101d1a6d257a4d464eac55bd901f77a99ef95871c14a84471c8937590c59a44fe04d02c5061a9483842dea155e421ec12bbc176b0a109cb1497cdc8f0e2ff05f6c45e4595ac5ca1c42802bf21d963b92871f286fa958ef1ce52a468e217a444f8482e6443713cadb3012fc9f0b4000000043b4fd16a67840ea0e71d18de81fbdb0c6c3c1a40c63cb140d5956c50e23e3918d8f0ccc65bd2b90612886abe9a62a619987af7c5fc03ef193d0ec0845e4cc54	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "426696466"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2224	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2224	iexplore.exe
2224	iexplore.exe
2948	IEXPLORE.EXE
2948	IEXPLORE.EXE
2948	IEXPLORE.EXE
2948	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2224 wrote to memory of 2948	2224	iexplore.exe	29
PID 2224 wrote to memory of 2948	2224	iexplore.exe	29
PID 2224 wrote to memory of 2948	2224	iexplore.exe	29
PID 2224 wrote to memory of 2948	2224	iexplore.exe	29

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\307a7a22f3d106c2761691d0a102080b_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2224
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2224 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2948

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b90e979dfe54c6330583d0ef1aea6784

SHA1
6716ecc2ca6177ec13225e30bf01bcacd0a55297

SHA256
1abcc49f4bd2e0f8b99042e8ade4a50ccf252616c38194bd2ee3c38c09965195

SHA512
0e646b81700befbb45a0bf11a3d80644d5938f6b931690a2fe4100147b4e4ce6fce4c249895b6890a3027bf984e6cc4772903a861773a5ebeda45b2d00e5f140

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e6d2576c06829262ebeee56aa6a681ab

SHA1
54aaa8682eda792df096ffa178b70014141362da

SHA256
2d9a9ee9544e128a476d5d63e820b49bcbe1184c3b61a5f3d0cec5e4f6baa4f4

SHA512
c00f32dea1ffae720fe3e150d640eeba406976a445db98ac3621202a7206399aba943a98e42cd492f5002dabe2f8e386964211bfb49f934683eef2942184c09e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
11bb0fb3950136c647717183291a2cd2

SHA1
c2ace0c7a9f4e8c476702054d7521d369c5d562e

SHA256
d98ff3af566e3a60352cf89b1f44ab06e9bd51c5b3891685ec79f090fc179575

SHA512
f840e3fe5449d01a33e2bf8b0e98a9d9204544643b2524db751091af984903ab972ffeccadaae8866f0f45aeb5d34586c380b8883640fe8940c6d9415bd6a40d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9e8a535eb0c6367230bf5ac12a075a48

SHA1
0fbc10a284f79e4d9fe5841a9613744f2ce38a90

SHA256
8b91c72ef0e2ec8d2a34a9dab58e328e4ab75c59f1641b8698d3a84e86ec1182

SHA512
ccc94bf401d3000c79f88666f56cfadee56068f9e97468eac830d8783690f2d019e02ed84e28d2f2e4d929766f0bb99010b7ad586489db611b733e8ac18a8b40

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
06ee403a8ffede47f4f6eb5a9cb13535

SHA1
5ad5352a4085c58c6bfdc43e6bcc682a46674021

SHA256
df41382cfffac36e6e6c9ae218b57b13946c5493a42aa180366727779b99c9f2

SHA512
263c3dab3eb7889e2d06f356d45829d3ef4779003ec53964b27d7560e4b2cfcce03a61dd1058401a8a435a4d238a799ed707cddb2e05e9278271b4518fbbf8d3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e68f6b7ee92457c7592fe8374202411e

SHA1
3959d3ccbf06fe1048a6f7e691fc4afbae64433a

SHA256
053a1f6ed2f5c8208f27f0d5ec636857cb8d109cfbe71a10b817783664643107

SHA512
04c985ee11c19095c0598294aff289ec1fc97649095aa3ccaafe666d811ee26871687379dc8e3b4d346225cd7af6994f7deb97cf90ac008961bb8151500ed894

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
68f909b06f29984f12dfea18cfcdec5e

SHA1
f4633b9a9ab853c44636da5d59d5bf811e1be8f6

SHA256
a24517c45c3c77a60b2e550f1de9ec4344197a18018f900a73369175b22502a6

SHA512
00e6f12dda1bd07a4d7bc8e2d984c4d819c033e31bb5ef2b056cb728c4f1b9524a306aae663ca16991d785601ac4c1614d27083d887a5ef9cf127cf8f4d83172

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
584f6f48d95458d8c7196bddf2880201

SHA1
5de1842ed519cafdda77ee060b20f18992d9091a

SHA256
280de98e5634759825ea00c995cc44bc7dc9f5f71444896b53d892b8cea121c3

SHA512
b9e7b8ec98f71c193a1afdd246b6035b8e626f06e5324f12f892f920930a055d0aa9c9aee7846951b193fef96b086df9f65e22f8cf196a653d01cbbc6ef5344d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
cc2a31cb3f54efb7a8344a4a4ec70a01

SHA1
1d3da002e9b0983f0e766f6f1476069f3210a382

SHA256
b7cbb902a5a20c033e6de4827b14e982b3540e0547756d8865df09675c21fca8

SHA512
22293c128245663531c67d43db3a44e3f9e3adfcaa2549d772d27bfe1c891aebdb305e459252ebd9a7018fd17eec472f7663f2102af6064755af9771efcd8396

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
773914a078794d09cea8602ed1a9053a

SHA1
bd5061f16ada36af021745aaed70131106bd911b

SHA256
4ae0b4edbd8ffe928e22934c3645453efef2386b2ef3de392a3834cf13f2c36d

SHA512
aca5cf8950e44a9935e22fead90ec6357f87e78a7b2e8fc0262e35fc46da0b917b4b0817dbc03781ff05ca15e3daf4e6553723b34f66c153e0cd8fc79e298d05

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b3456229b7a18b61d161234316d53d81

SHA1
5ddc7c717b1928654cf4f4583016c0004df96b47

SHA256
326b6e430064b75f11c9c1171d460aca262b4623be98810c73aaf2e297dd29f9

SHA512
837253247580b0a89b2ccc90a31d21fa964efbd5925ec9daf6d6aacc3b825d183eb3f09e41d78478e1ad8f4b3ac21f5e45fe7ff20103c4b6da556b5b1fc73e4a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ff84633b01ca57ad4f0b60d225665545

SHA1
c13e76657352a8d22e4dd93f8f44a75c4ff608a3

SHA256
3dcd225c31bdc4fefd2fabd7a576e898332182163ad72f71af4a03a4797abf70

SHA512
c5d3b4c18b978a23d51f5f36cbe1fdb4b6400052940272809187f09f3f2e599c3b65948b43a28859d22e1a75e53bd570230e59490144e1334700c5913ef7a6f0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
98407185ce9ab21141f7c7284b05bccc

SHA1
5de0e193fd121af09855c527ee8426ca3bdf204a

SHA256
1310f86a38aaf16fb9cfa9091ae01ef2cd6318f9853018d5748e95061c9881c9

SHA512
0d1f5d4b6986b7fdf9f4df961dbce5d9b166d2e9d82e7ef3bde3ed4ab3763e5f5e9c793d8edc3762e4164a59265bd05a259cd95fadbbb9d2a0e1d07fb0ff6d5d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
39bf38e5cb12f3c5bdc63ddc73c14b11

SHA1
5a104c3b594b28a13af6328f6b6d1c9cd4f334ba

SHA256
0ff2697d65dc67cb942bb0f4aae21bb9f69e2c28895d96fce949495fb5986b27

SHA512
1bce9f09c435c072dca53a28207c945618f304154d2d8cda5f15b1134e45f4379a56621fa4a7e2f424d42c65439a9faa4504155454250f02132a3d1f86b7dce3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f7c6860f478fbd0240d5fef3a94b60f3

SHA1
817ab78813e697ce33633b9d24e87a0dcd1e91c9

SHA256
59851f0bd453f5cd9514b6aaa094469f9e1936061778c50b33df6f40657443e8

SHA512
c2a348b3efd1ae70c5ee33d7d650a59458fa44b8a8479cc570b429c3eea840d1fa9df31298a20c6dc99ee0208e5e921b9800ddb340e477edb5e34345064d283a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b5dab344485b7fb884b5c790242649bb

SHA1
1ec913579cba36ca5fb744b2fab5bde7a3f6f768

SHA256
3d17699f71d0b3ecd14feabd0b8f9126ac4a5005980cea48165dbb9dfc07fa79

SHA512
16441162f0855bb1b91e9524bf65ca5d741899020f26d2877be6fe364d3b96f618b504dc00305996e6aa301e59774c617d6f7fa6fb395fa1cbf329ecbccead57

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab8D34.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar8D35.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit