17384faead95dbbeecda6c0230ce315bdb62b8a37f38083c0e0d07ae2c84492a

Analysis

max time kernel
121s
max time network
130s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
12/07/2024, 01:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3b95583b5b4ebc05c9024449d635180d_JaffaCakes118.html
Size

53KB
MD5

3b95583b5b4ebc05c9024449d635180d
SHA1

c21a85147acdfe19dfdadeefe6556719f51cbb69
SHA256

17384faead95dbbeecda6c0230ce315bdb62b8a37f38083c0e0d07ae2c84492a
SHA512

cef64b39a628398576a1b2e9f96713935defe4e172f54f20500e1f77a54566abbdc2db3c5d974addcbbe38aa22fd503ab62bfa3c815c37fb0d9997f2850e2fa8
SSDEEP

1536:CkgUiIakTqGivi+PyUSrunlYQ63Nj+q5VyvR0w2AzTICbb/ol/t9M/dNwIUEDmD1:CkgUiIakTqGivi+PyUSrunlYQ63Nj+qt

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = f0ac37e0fed3da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000062974e5b5f804e45b98349be16bffb7800000000020000000000106600000001000020000000cf16d55c11baebe4fc1ea455f66b75703de741b7441ed1c3bbac5367ee24ae8f000000000e8000000002000020000000c168b827d4c99937d7b2e804f88d4cc02ddfbfa5d62651c045cfa7e6ee6087c1900000002f2bb1c72723d220e27c8b93407c7ac40b3238daadaaaf46b24d04828584018586e59d62e01ba4246b6a073227f3d86027146766e1bb8cb780028a2bd4b6217d8b74d1717daa5f924b8dfdbd9909e3080b100496974edace1678e22c07fa4db22e7cf268de197169e0e37535d2ac324c2cdfe9400e279b8177b8ada1ac6120fc7265ee47724e65464aea1259dd3f56a7400000008589706d2769a2e5289982d39c0cc1fefbdc8992e83d91abeec8d8ecdd30a3f335a3586a06c85540728188ee8bcd5915855f307dbc0df1a0ae39c2e7b7e34098	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000062974e5b5f804e45b98349be16bffb7800000000020000000000106600000001000020000000981a98b2bce2993f6797497cc7d7e567ff53ec35510fde8791f7459957dec1c2000000000e80000000020000200000003c82d84d4d698e5fac94f5aa34d5969081761bc8638eaca5f5b2b7f51ecac0f1200000000287780f744ceac4266a837edd8e485127e21c92a8308322b757dc21a05ac2c1400000003b3b75f971963c6676edd392ca0531ab3d9a2d91f784de1cae0566055584df0c2ccfcde9d4da60d0f713568b91886664c67134889ef91de9ca3a09aaa241763b	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{09567801-3FF2-11EF-9245-EEF6AC92610E} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "426911291"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2396	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2396	iexplore.exe
2396	iexplore.exe
2248	IEXPLORE.EXE
2248	IEXPLORE.EXE
2248	IEXPLORE.EXE
2248	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2396 wrote to memory of 2248	2396	iexplore.exe	31
PID 2396 wrote to memory of 2248	2396	iexplore.exe	31
PID 2396 wrote to memory of 2248	2396	iexplore.exe	31
PID 2396 wrote to memory of 2248	2396	iexplore.exe	31

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\3b95583b5b4ebc05c9024449d635180d_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2396
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2396 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2248

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
baaa283b623f86bbd22a3264c2c3c92e

SHA1
068b29ac11bb6d986416ea9aacaef895f71851bd

SHA256
0bab22d5c9ec97b2df333161d9b682a1753c89315debb7c4b1895d966ef2a07d

SHA512
cd455bd124186221350ef50a258cfcd1f571933771d327948db36b50a223790d73e92912f98ecd4bde3b8e6c5169da697299c58c5d2bb74a53714d031c1d2b20

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9ff410d8b3b14e8a7da34db424df5a99

SHA1
3ed5472e59c5208b2dd09408ded8eb46e521a244

SHA256
71dca479d1e6ff709e780697605ddeb46d66e6b62882f68c948a90665e7e0d69

SHA512
9ff2a4e5a9afaf35d6cbda3bf27844da2548f6613d0125b9ce3023fab59f35718bf29812a682df64159c50fd8502a4f3be9b997f92116aff491e13838c4c7dde

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
17f37165461fc8e1ee2f5bbb1955df98

SHA1
4bb212d795f46f014d92c1df5e709d06575061c4

SHA256
753829d9eebdd86010d284cea6a91452dedef26d571bf2a6b0276979f7223205

SHA512
86e4eb9916b97f50d6497d74d47eeacaad2a33740cc077eac11587e1bd71afe5f6547a4d1089f2b1c86829cb1e60362973a860a5aa62a50b12a7170bcacdd8ba

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4ea5a33ce2b388efd5a448db59e582e9

SHA1
b381c2b5064c19afd106b20b11e2149ecbf1c0e1

SHA256
c995cfa54fb0f4c51c71ea272c9ae5e229ec3b40e96b7a67003cfe9fce811cfe

SHA512
400d184a420225fdaebcff4995de685756bf81b6737c2b94962ddf732c34509ac48f1f2d8ea5611201fd037633373cb1a175b500c39d57bdf68c9d1008f98d47

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
24065808bc82f7b8b377652970c64b0b

SHA1
d9fbf7cdcbf61a6e231f5e7a5a09663ac25cf875

SHA256
64fb66c9b5e75c4dd62bbabfc0b408ad8cb72ef2a411bf385d8288c71bb15732

SHA512
e282c8c7d6c3da57ed2162af3e2393ccf9e85bce4775aae0c7df19afa3b607d4db9417ffeb870bf8b9c849b564645c10071eb390cd1c0a683297e23f6d350ded

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
87a6e8e61cd551054e2a5c80ef12f3bf

SHA1
5662bd62598afb68eec41976abf4081d4136ba94

SHA256
35c0a20be7e0fe5f2db7f477c759f09cd00379b265824d970df02205db4302b1

SHA512
7827b0419fe2b2bd0ce717f7433f382c3ce4759ea1b46ba2f452bd56feaa3e4700312661543868f907147eeb8e59e8f5beeb855317c8d8def709247d5abdea40

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
72bd83a152d5761518ce5da21f5ef06c

SHA1
05c8f3c4a237aef2e95aaf6932aec6708a3eddbe

SHA256
62857bfd6af6aa3e9a547c66c9eb9814a2ed2e717ed8573ca7f6c533d7b53f6e

SHA512
abc10bce914d28d0f44bb8fb921c02c5fb3241e59b3a279a7d9f94f21f7f83eded4f4fd3a05397214f2234898b80ba3e2d3f48e6bfa112def7112b1168e57d8b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9da7c96397d35f3eaf2da14acc2d9bf4

SHA1
4d849a65bc1f45d545923a91579c950ce7f19c05

SHA256
f55319c338fff6a3066d66d9eee0e63cb6b5c653c1a889176b4d1b20c3aab21c

SHA512
aba1f8507267bfea1671e37a2f0204faf3195477f8da1b3cbb08f84ff20ade73ce327f6bea42140387cbe975d4ef0ef3d21f3be200dde8511bd7ae88731cc2b0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
bfa0f7908eaa6b9c00d7fa4322ed99a7

SHA1
ec2794767bd4b8d970697d9df7b34d8276630aef

SHA256
94898f2ab5d17264aea21f5bd30f7a73f2e9832c1a85b56504ba9cefeb67e2ec

SHA512
6b40379ce9b3a46c0da26850f62a9e8ec0757db2545e3d075e0da8a73582d207ef757fc50128659fcf0673ead42fe41e024dd35d371d2590f2fb58a739416f01

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
25cf48a06d5d5da9da602f0a0536fea8

SHA1
3bcf9d0476b64523088b27266275c65b996cc5e1

SHA256
fd564cf098199841d5d035ea71ba5f2193c8ac5d2e89d09702b4cf5b2754e6f4

SHA512
f06ca431efda5ea4c699ae817e68decaa5c6351b93c547cfd16f9340de73924995a35d4ef732c10a8515a754c493304291e6a1e95564646d0596f5f0330d6113

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8a305475e32e431d24fc25b2e9e6fca9

SHA1
301cdc357a774ec5879e752121b04443b3471a36

SHA256
4bc832f564a6408285bdf1306c27e5220016ec731888ad1a9da7e3b863bad66d

SHA512
5ff4d466d49242b3b671df3e0c5dbdd250b29762589f5e36900dd71b2a192d8b59057f9b62593b56c0eb982891a48de7a29362d742bd33de5f3b3a5d0bc3dd06

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d22df6e77cff0042799e78310d37f07b

SHA1
190a0ef39df05f20b125bdf5e8ed87127e06c2fa

SHA256
9d8d099f6bbd41ce2b64ae66f78df54c08e6b464614de325c90e9005b8419289

SHA512
e3e45ec9b38b7b3a3607c087e2d0c2fc7dce01b662911d244c1c19164fc04f264e750bda010e4629fc0ec68d3d19c6c29f02415fb380b1247dd6965144b3a1c4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ffea54a87f80dc5356b1dfafebbd628c

SHA1
f63044e041ca450409e34c1b65a4bcb392cacdad

SHA256
9dcb1bc714aeb8bea1042d9da16e1c50e5f27cf5cc1601de8865a0ab83dcba88

SHA512
0cf4f4cb5d7cb1bc944728560fb0a39896f90f17e9b5288923fc4dd03a1edb883e24279f4a3d39d17ec40fdeb7f622d401acd03ef756cfa160d27155399856ca

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f449f67683424f711a23fa40cf4cd750

SHA1
5072e1145b80fd2362ed1f86b41a7eb96b316d18

SHA256
bb08a072fc4cb6141e56db0c7e03e033765c165d12c4d99008969ad32ced6b42

SHA512
a0e43a1c8b743d020da0cd9bf8bf8c4b2d45ec1cda6e0399166c8aec7b6bad22d99c0fb5dd0bc2de83b0937fe3872af311d2c74dbccc5269a4810efb375f07a4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
bedb564a277c4b1e6fca62c60b486f99

SHA1
e49831141a285283a8208cb7ca7ee8afacd0c598

SHA256
96653e8bb474e60cb63bdc645e276ee777e26d8897cc381653083edd703839e0

SHA512
4785d0263ec057e23f6268d9e943bde886171022e226370dded36d84767edec0b135c9f2ba045fe5e8e1a487552b17c27cbf7b5f13f566b93694212be23ec8cb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\X761FPIN\useroff[1].htm

Filesize
706B

MD5
67f3a5933c17b3ab044826d3927d0ba9

SHA1
5957076d09bacaa6db8ddc832b4fd87ed8f05f8a

SHA256
97e800f4836b7030dd58fe6296294b7ff5ef1b5eb0e88353f230ea1608d2bb64

SHA512
03ba224055ffdbf32b7eea30c764dc18d66cc6d8707dc5fafab74e155b0bb3d4d691c5788b033a68f05299547297125122778fa7e3252f93e7343d918936643e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab4A5.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar506.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit