2af228950e48a78bbadd4a4370dc9b955f7db69516827f6969bdcabf48b95809

Analysis

max time kernel
140s
max time network
141s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
10/07/2024, 21:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

367c1d2205592259f56b761a294bde08_JaffaCakes118.html
Size

122KB
MD5

367c1d2205592259f56b761a294bde08
SHA1

09ba6747f88a0fc12f1b05396dfafb03c7a5186c
SHA256

2af228950e48a78bbadd4a4370dc9b955f7db69516827f6969bdcabf48b95809
SHA512

ea9832b709cfd6e184d0ac55b10f05d9e146a543a82a9eca708a37b9653a5b97d04707cbbec9652f921423ac5cc04bc746c183c04f87b857425266f8eb0726ec
SSDEEP

1536:SflzlgVuW9yLi+rffMxqNisaQx4V5roEIfGJZN8qbV76EX1UP09weXA3oJrusBTE:S4YMyfkMY+BES09JXAnyrZalI+Y4

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = f022309711d3da01	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000062974e5b5f804e45b98349be16bffb7800000000020000000000106600000001000020000000283c89371ce4ccf242e2cb26394e09e352f260f40ba91366bbf80b94f9387d0b000000000e8000000002000020000000da21e2f862a8b91f8430ba37d717c375185f3e75d009491d700b9252ed39cc81900000006627c2f117fa4bea6322e12460240582948ddf4001b85ca4eaa80886dbeb87bfab94aad0509f22aba51b4e3a0058c9b1b51e56d9546bfa95b8332e75b385d6d2411166421cc975975ed8d461b8ea2a27e8285a4cc36fb501a590b1b1b12ec7912f5a797df79111f07f39a7932c2da0d4b4567196077ba1aeaba2cd2b9ae5fa2ee14ed257b26bcfea57f90fe35cc4c28e40000000dca42b9c3a3a0d26b03e073ab57490f1c9e659aecb82d1cb9025fbd76577b25c56b5e8be523cc4acdc401351da92dc53f020d553773aa31f44d4bfe1f39caa9e	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000062974e5b5f804e45b98349be16bffb7800000000020000000000106600000001000020000000678b37453fe78863a0148c03d20783f144ab77e469354eb01e5254ae1fa3db3e000000000e8000000002000020000000839b3634357b97658caeb6d160f45cd8a94e4abd793b53aa2b5c94b265fa86b520000000bf53e71180bdb1df22dc555c3726b2a04ce0b10fbcb1ec519b9149e8c2070d564000000080f30bc346f7d09c0d3607f3f8085eba9bc02de3848dd6d5d8bfc1d504bd4d02f3f27e1a6e1d9eafd564cd6e903cb11155c80405779ec1d1a8b19bc2db82d4fc	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{8319D4F1-3F04-11EF-B49E-DEC97E11E4FF} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "426809278"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1956	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1956	iexplore.exe
1956	iexplore.exe
2696	IEXPLORE.EXE
2696	IEXPLORE.EXE
2696	IEXPLORE.EXE
2696	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1956 wrote to memory of 2696	1956	iexplore.exe	30
PID 1956 wrote to memory of 2696	1956	iexplore.exe	30
PID 1956 wrote to memory of 2696	1956	iexplore.exe	30
PID 1956 wrote to memory of 2696	1956	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\367c1d2205592259f56b761a294bde08_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1956
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1956 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2696

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e5ca4fadd5e609c18ef6101790ccf5f5

SHA1
bf159f54e7eaf4377c1c09684208e7834f01097b

SHA256
1c87c040b83d9871d513ceef678764d20e22a65f42ae92d50612104fc31aefca

SHA512
f8ccaf54c69bb9f0b9882e276d57ba80c6055fb625b257447080bd13c2d28026d61d4b176017bdae2ca4a48f1657a27fd301f54edfe11fe3cb56e442981fb37f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0741428ec5836f8f66d46e040714b7d4

SHA1
a5258a7ec0d36ed029cb50500f6bf97c6b4aa18e

SHA256
8130f9617d19d0b56a35ff5d1d118e32986b06c44d80e6657e63545cf796ee67

SHA512
bf0d706a83b0762a239f04faf5e144cbe119e65162358efba7733d3243b34f43d42c0b4ca2e0ad8db5ccbfbf36064762797da639c285f8fbf294a02e3a0147e4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2bdc463d701135038b1e5aeeccb8eae5

SHA1
249928a433bb47ddc1ad7f5b7997502c73f5d858

SHA256
d763f47d86671ffd27e885676fbadc37b87dc4dbb78be4eb98b72b9fafdc9884

SHA512
5bd0cd79e2bc788282b3511bb8930c3bbeb239800960c2b0977aec45f7da28fc6cf680f177f3003bdabb23bc7c590ff9e11005da6bb5997b67be06bc36eab45d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
18397a5919c67d33fad1862a367f7162

SHA1
1e61ef82af023ee04c3cf0014c4778cf77870381

SHA256
e491e3b9a108ad094a7093ce8f8c765a9a609f776c89ea700a286cb380fbeeda

SHA512
62b0d80b349f22b7fb82e0047507576fb4fcdf3f4fc06b2d7c221bc825b37bd6c602feac8605a37682a5d16fd47c73855c4fc9b500162cafdf42de7233a4a259

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
58bf2f83d8c5e0de92f8a1e1d36c8348

SHA1
24d4fa58165bf5ce8c2223f3c84fffefc16d081e

SHA256
14ce42f06632bc3bd13078816ebbde13e582fe368288007a0a2792ab728dde0d

SHA512
1685850ad1bce781a774ce7b1bea75b4d075974abb2e9aea0df712f50459d163d635e919fb9b7e41075a6c686be6f9e7a03854383ef2ee204d35bb1f16571600

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a1f03964862f5f0b696d27d5c3e8dac0

SHA1
8765681d8d841b6c582179ea4daa83a69a6cc154

SHA256
391c3dbc41dc698bf5a9798833a5ee8f562c18aa279cc7aa745d9c83be497a71

SHA512
921a3404d2489bb200166f92e14d60d59de0e713ac785c9e0bc1740f47416b125041f7cf83b1fb50b10427b7f06738680b9d95e0f89e36b5d76cc1405b5c0f66

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5e1e3f08397676b03a59aff794d92511

SHA1
6f25d4af85417a17c14a2a88b2922952f0eba084

SHA256
046d2f23f3beaf42a54cbdcf51f35968e6ad711fd750dfd85553591683bba8e1

SHA512
3f424edcab470968915ec920d7ac3d689f9cedf24d10157e4995de7f2fc16a536067a396c889a915318d22d83fad5d5d0e76dc64253313ac57af330fa65f670f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b1b41bd61000c9695b6510cdb3d363a3

SHA1
51f73b5f9c5fd1c0020e3a4083199e441c5e2be0

SHA256
a5fb885aba03d36b2dc3f73d19197b4c1bef121459848ae6d721c14228da169f

SHA512
ddda2303059c3d8cf83f7d712ae147e19fdb4370ae05c266f57fcdc0664258d8551f2c358e4da2e33c9cff94dc1eac90ed57b0f8bf202eeb1bcd93ccb6df9a46

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
62cff857fb9e9c535de1c99167017070

SHA1
5a3866ce8d76bcc9af59108eec83e38de3953291

SHA256
66e313d786e5829702ee1d5e418598f6fc097ae3d3e9ef02d7c2dce172adbe74

SHA512
58df946851f2116ad055f1a1bc7bedc27d524670f0c425d85bda118fa62f330be6e7cc5ada01e7965569d2e53243c58f37ee746d39f30567f010c992ee6b154f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
fa738addf0a703c9a9c984476ee527cc

SHA1
3792ffdb3bc34600d747f87e335eade8c6a1b90a

SHA256
cd49f8c4fd0f1e696b6c94313ceb1a9b33a90a9a5dd5c5c7700e0dcd7360ece7

SHA512
cbd9850a2914ceaf6bab59811729183bee452d734df3ae00c2b9e3fffb73301b8c184e513210b2c412d7185259509bb2180d61430104084d24ea12f44d4329f7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
74b41b311167c4c948632570ff00acae

SHA1
4c68ddf2755e29afe1847ad02d0a5deaea36e680

SHA256
6659253ada371e7039e2d82df3f34c81f42b0330b31b1e967e6fc13fd0b0b1fb

SHA512
e513edd240cd188ca85479ecda6f93d405cc69c752e7ca8eb8765de21c361a62742ea884835cfbce2f215c546a0580a98c83ab986b67bf730a9abb9065128ceb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
49227ae0c11c472d436c75c32b942802

SHA1
7cb5de9f3183172794f50186b7c6915d8082ce30

SHA256
c27f8cb06d6754d30cb7c3b792c8f7835b9d4a40b1584ce5703d9418b5f2512b

SHA512
33d0253aa5cf2a24e638724f1e257e8ff07370092d2a2532fccc624ec55d8a58ccf582b911cee9ff665ff23945d41dd68e9212c9fa4f1f61d639b984c26429cd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
54b0aec2bcb7e6379c1873620cf7cc50

SHA1
7e114482fdde1648f4c1f6bef491b8d88bfc5db9

SHA256
bd7563f3d81c1083e520f478199cb3ab9ca2feaf66845c1aadda8de0a4959e25

SHA512
e705ba0b86461cfcc6def2335475e746f6b99171936100df0d3acd227a91586314abd0058bb93a1dd139761ae5973c2136d8bdf6b24a2b0a99cc17c0e892381e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b10ec42b092d63c7780d841b0067b244

SHA1
4a96b3a64ec71646c3e594f098bc718e210cdfec

SHA256
46b797392cf7f13e77e21a07cbf4c73f2a079908b801699179d12b2f8ff11294

SHA512
b1e3f0b052312b7cc4f823d80e8394bf81ca26d7e6af9943d89f169b4f07b1fef66b6c34da8725281d40c8ee9674554c4a0a2050e4928f520abd1b995cd02969

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5d4986cac420cd6c226b12f9956720b1

SHA1
83a72b2489f48658ef4da826ba52b2cb5cd0ec32

SHA256
429cc17a802bdb860da8c05cdc239abd373ff2e81d314d95053aa6a8d83c42b7

SHA512
0ddb90d3aa57a8f863517c53a86ff82bb12a5a4e22a97a6e687b25570698fb3eafca9d7e0f451fcb4c4271cd63b1e74dad172a69da7dfcd4e29e01de137899f7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5bdf94431009df0ce7621273bff28e8a

SHA1
334cd0754ce1d0ae1291792317b8fa9c6c1d7bcb

SHA256
71e4df77be5cd94691bb2bf5cb67854477c9b1f18f5f6eaff58488258318623c

SHA512
bbebe56ea66bf60fd9c75685221bae8846e3a5948271cc91027bc9275db0e271a2092ff868b7870f6e42c741b49cbe25f1bdfff3b19bb5c7a4c1fff0cf70f90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabFAE4.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarFBB2.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit