03c987ab8896711183763ff6cbd3ed584ba9e50b102b4a364055adb77f65e816

Analysis

max time kernel
92s
max time network
138s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
14/07/2024, 22:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

470c4346776684f4b82e402bae05c22e_JaffaCakes118.html
Size

6KB
MD5

470c4346776684f4b82e402bae05c22e
SHA1

490f053acfd1c61142abdebeed719a0ac36f3903
SHA256

03c987ab8896711183763ff6cbd3ed584ba9e50b102b4a364055adb77f65e816
SHA512

1963357268702af98558d17a00eece8346a686c51dbc05d8342e5d10556d68528dbdd00b841875ed0a6541bcc51d7dc067313a228690e027e05b40a7bbd30c3c
SSDEEP

192:+Yak/aQgdTrG/2B/Oqqs7YASMiiNy8eGNl5PlLFyhkQt5kNis2jQfJ8k5BZW+uZ2:+G8dTqgdz7YASViNy1G35PNDQt5Rs2jY

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 30b96b3d3dd6da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "427157972"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000003e1c4d4a7885794291b78de8e6dfadfd00000000020000000000106600000001000020000000e2ce5af7334d5765dc411f1b2b5aaffb9beba4d8a2224b3ecf630c91c716ab8f000000000e8000000002000020000000bb4a4437332f035ed9eeaa0baa1894cf00a906d76d6377b114cdbb46cd72967720000000d1a9472f336135c51189a034423634dbeb524f94d03533cf579c83c6043a9870400000007e92af1313d14e8da8b5ff1ca23cfc5a4ec59a04a17dde1f16e94543d61f254140fb6f9001a5f12879e7452ae09f1a093a153828b9da80735ca2a1f3b04af3d7	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{5DE876D1-4230-11EF-826E-EEF6AC92610E} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000003e1c4d4a7885794291b78de8e6dfadfd00000000020000000000106600000001000020000000d4841ce0cd1878fb8310395e52fc51a68e0be28a47b2cc3de81c0b8eaf0e6076000000000e8000000002000020000000ba48dfe8a33d3f566399e7111ae4337bfc69a7a46999cae029f66ac463abcd3d900000008a7d00c7f831cebccbc5e7851d84909d826d5732791913562f49b5412d00ec76ac28091e9e9c90b2a6b29142b68aea205db635c0265cf23921130db9bf73853871597c156c7a5b4575d198278ab2dc4e14ed4a7e5da6e726333fc2620d772ebba3f564542370f337ab8a559ad865ab51805e1cee57b0847a05c876f9be4997894b4f5ee87d4e0c701370c64863d666674000000002ec30f86988bb32a338a80132cc4493f87302c410a9927bf5e10ee00d1f5acc8da152e9c24a440e4c52a08f799a7d9b10e9c770dca3e0688fb12b66bd0e02ff	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3000	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
3000	iexplore.exe
3000	iexplore.exe
2820	IEXPLORE.EXE
2820	IEXPLORE.EXE
2820	IEXPLORE.EXE
2820	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3000 wrote to memory of 2820	3000	iexplore.exe	30
PID 3000 wrote to memory of 2820	3000	iexplore.exe	30
PID 3000 wrote to memory of 2820	3000	iexplore.exe	30
PID 3000 wrote to memory of 2820	3000	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\470c4346776684f4b82e402bae05c22e_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3000
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3000 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2820

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b6f5a7aab8eecd9bff32937c06eb75a7

SHA1
d084ac1ce047f908ffee3f9a9d258d90f731c869

SHA256
c540d019da8ec25eee1a500f42eb1c02ada7f622160d630145cc7114fca390ff

SHA512
f6da95f0d487c8631b31c4ba3c960d706dfead7b9fbdffe6c660714c9e2f3774eb750891c8da8760e4424fc301a1f57849a12aa140903cebd8efaf61a2202976

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f03166556af24f0c13014b0ec882fe44

SHA1
d6c26bab39fabe31ca3e7a677dae7d4245d3d4ea

SHA256
55fe9bdb060052d205bc05a21bac1054af58628e6868254f5a836e27951cf04d

SHA512
784ad91c68a445d380195fff6cb670f26ce946104095f11f7ff6959f07cbfab3abf0536cbc52e333b10ac45392250a0233355678793ae355dc0c759258ec5506

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8a65a368b3ac46c404a2667c4a32f9f4

SHA1
fcc1be86d46e816270f70dde0ea29e107f0c66f6

SHA256
1ec48d3a48c7f7bad09dbd93fa2c2c4c4ae9eea085ee2c9798c0dae595654f93

SHA512
32e143e56424537307fb2219731ad24a7bf5c601f7229fda123a64227844f6c90f7b2b525f016e7e3a85a5f575529d53e7eb27f1d4ffc3f3714283cb187bef24

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3e9064337aaad739f8730e465e12c0bc

SHA1
c8790f5f91b7a14de8627019cce9747da502acb5

SHA256
d8d25f8839131e519ac41e46ea57a94da9ca8bc183b3c5146c7b7c7e5b137f34

SHA512
2e5bd30a06a63f8559415e1a1207f9a71578908930197dcd362bf0efacbec760e9d00ea8d8b782f5b3335714e40f067b7d64d609fce12d8b4a880a526adb452e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
fb42bb3608297d5faeca82ff16515a9b

SHA1
74d277bdd8015a29d04af80ea46abedc693878b5

SHA256
ca7276c876638b57f784a9115f264ce9cbbe00f5005a47e4f3d556464ef42590

SHA512
01c2be33c46082340e1341ede8a77e7edc55d160e0bd886dc27dbbe24a52048e9fa55f13898e3e80694ff3bb515a03397b480798d232e426272747c28810f502

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
744d52fb8cefb1406b181a89e9c670d2

SHA1
860adf8a60ca1181bdaff3978ecef2912c0426dc

SHA256
7fd9d365079ec95e4c635ec2cddd015524af9c7f4288fbcd0ae1bb85bb98a86b

SHA512
05efab2069b7570723fb62307449d3af5bdeb852e4b895ab888c8c214837bfc53ce27471b3b0b6f64423a4ad805ef25dfbb4f71bdeeb1c3c052110d1ef8c4734

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c483a9955c13c8475cc51d0045005429

SHA1
71d1a52853f410a167d8ed89fff20d74d6e8a84f

SHA256
96201d170664ff7e3b6ab1192947b313f2a9eca8d8fa8734dabd65935303118d

SHA512
57f94c6b89b267dd14fff130b9293552b71a6b16cbdfc0b56ec0ad13392f14b017011bed8ef7a65179dcf255e9fc16506f11eab8a6bb367835c347388e716f2e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7083feb894a6625f0122b9ad0d2b3a19

SHA1
353c81543b20f2aa444fba295ee21e49249b9f9f

SHA256
e63014b79aafdde2fe588ced17d2b113e7425d224ddc4245d1b14941cff7de7a

SHA512
98234080d4a15fa01ea710a297ea69c2c326048a7406b556617b1fc718795287c61e27498193ee7f2b60337f3e56ce26e025edf792f2efe4483e225832a7ee7f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6e83cbabebdaf73419ba6411fec3c34c

SHA1
daee84f860c65bda788fb595b5dc0aee9bdc6816

SHA256
6251c60b54f75879f8be3134ce5aa4859e2e98f5ad8dd57a283f1a09e252162a

SHA512
0a5094bcc477aa87f6ce470b1e2d6d898101d2b8251b440a928e2d71ab254c687cb70c74eceac2da55842d269a357d82a19cd40e5f9ed8ecc76ca60016a688f5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0318e6ebe0d56461ffffb8f75f82a9c3

SHA1
06ded83bfd3da78dd2b40d456636be2ea8a1c830

SHA256
f80d252f28700439741a5e75bc890cf9590e75d3427570959ca089577560b9ce

SHA512
1337e5a0c62166fe132d2a1bdce4d5222ce1b25ddbb3d210d0873f4f55edf0fa1ab00948e05f664138045f6949f78aeec60487357dfbae7118dc30fcad10c940

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
61376f233d5f22b95d0002fe387f52f7

SHA1
1c5f16705ba1aecea6dc871251c9672fdf99de67

SHA256
41e7bbd355cb0b50799e11ab340cde8387eba78861cb32bf4edd8d66eacdacdd

SHA512
0b8bcadffd71d091f468f3d0cbbc3b616f4281396e3484bb03932b491590e744def753556f2bc236d985ed26e6f12a993420ebbaab33ca7d649385f1342fa5b2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
72756d547be5e47fee3da0d89cbc766c

SHA1
82fc42f71a45c2ef0d9de13caf6c89ce9406dce9

SHA256
f15d82a6590ef8d5709a0faaf0d9f826b63b8e31cb2e68a06efe577c2a3b203e

SHA512
4bb47e5dbdafdf7ff8d8545fd806f15d3cb0676a4826411de3e9a89acb8ea89f24cd15e43418b8ee3e6f835ced3cb81f7d11b19c4e098223e87b34ad8dc248b9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
37634fefd5bb267fb1f18f9223a85e28

SHA1
817c5f6b2c01c85576813ef0b66cc2b8fa1956a2

SHA256
3cbac07a01f62bce842ef9ffd54a5198e0a6b0abaca267b8efc8efdac96a0ae8

SHA512
6a18ffc4b00af1343542f816a1a351ff8de7e5c68b4284654cd891d7ab8d829310fbc041628bb75f79b96dae613bbd42d0c3433ee29d9f94378753fccf81f931

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
01a69801dd141396b68626125b44920b

SHA1
57860bf2472f14b591710310a006da7a199db720

SHA256
c2018d5dd707de42cba815afb61f28b485afb7de5e0d562fc88ad1a9d7166cd2

SHA512
4634ab803d9b3773ad8431fe9415b63990fe664e25fe431257761b9f9f141f5e7194d2ed03d98b69fcb0892ff13b8a8899c356f851e5620c0ac9427757e18591

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
04d944bbfef270a391ae978070b46e11

SHA1
6d8da55bd54d39888567392181cd2249154da067

SHA256
f80109b5cc8c65b9630acbf39a7fa944821532c4f728ac2ea1d97930366b40ac

SHA512
94601a0aa9d51f800227280548ff0f03375aa88f61f8ca09e76047628535ec3a5db9a853823d9453268add9a8527b5240993f52d2e8040713e12ced18d820e42

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d066a949403e3dd2bf6d8e9881068a6e

SHA1
507cc89b669a91b704679a3fb841dbbc77a2eacc

SHA256
94f7f2144ff495fe97360deaf9b90e7784755842996a91baa435a109d6f8bfd4

SHA512
a049948befad1541710db23a79c51785b8aafb0d428e436ad965677d4b1354bef3ad024c98a7487526ae1b74fbafe4ff5c3e719c08d2e6f7512e3acbd0c414e5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e6327cf02f688bf73c71483c1929071e

SHA1
0bf180f4c9744206b7d20fd77efcfde51aebc973

SHA256
09f9968ac8e734809efec1d4e03644ca8add4931274aeb7706812f64876b1f73

SHA512
2fbf18bee9d500ab059111a5aa6773a8b6b1524a52643540997899b08d7fd2c901508e6e83e6d5f5b97458ed65486c8e880b91edef46c944ed31f50e3ecfdc21

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabB482.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarB4A4.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit