971f93ce2a2b717c738cef14f81687b41bd3f467c4755d7272efe52838de14fc

Analysis

max time kernel
121s
max time network
127s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
14/07/2024, 23:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4755a3038e2d706b40869b72a207e712_JaffaCakes118.html
Size

58KB
MD5

4755a3038e2d706b40869b72a207e712
SHA1

24a87f859d38e1a113f06cbfddbbee0c2c3812b6
SHA256

971f93ce2a2b717c738cef14f81687b41bd3f467c4755d7272efe52838de14fc
SHA512

30947dd8075cb182b0c48068bbea6dea0baa4956af168bfb8271b0b0d13eb1d953f0157947dfe292822363cd6ce9c1e87ad3654d977007aaac794389382f06f2
SSDEEP

1536:/6rqiMSMeMCMQ3vSuLsjLiaYS30EULaYLPqLruLRLEvyLlALflLYrL1pxQp/1pXd:/6rqiMSMeMCMQ3vSuLsjLiaYS30EULaz

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000930ed985b08cdd4cb38e38023150682b00000000020000000000106600000001000020000000c6e9f55633815d054147735cf8285e387cf0d5807f06cacd92e6ab1bb4ed8238000000000e8000000002000020000000a714ac7da191c03fde3729ceb66f3bda6773177983ba6059df9a7b2297be402320000000c4be4a2514d5eef2c8e3d0460f82e643867fb4c053a39d351bd9f2bf837d35c74000000060761e8c088437a3555165890d6fd4260cc9a60d2bbc237b1e25a35343c1221ecdb7ef3e4925cb405ba71da7c9871a04513be3633df610d79639771cedd6a07e	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{A4D67DB1-423C-11EF-9AA1-FE3EAF6E2A14} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "427163238"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000930ed985b08cdd4cb38e38023150682b0000000002000000000010660000000100002000000020922d349cd5e333343cd5184910f689f4fbf5deeb641e0608f149d5d4ed4858000000000e800000000200002000000003c888bb3322ba9d525b20af47bb068a766e9a917f22ab592e30f7e09e66ec34900000005fa22e3031dc056757d283691a92a8aa4c44a01675dbf66afdafd7f9896616b4138f2dddc80dfe931d2e159dcb2f20ec6be21611819b5bf4ec3b6123eacbfd87b4a19f8b3f57dd9cec1cb313782600ec9d5e69222da6d51cd0101406766b6a592448826e29ee9147d845b24d80a2f659be6a20fa0487440650b3054fa61760001e2c7e9aaa66e3702249342ca3ee35e940000000d46bcf968e09f0923ba3cac200c303efe929a819c1309c838b80b5fcb149bd78873de7d53cd671dcfaaf5c0b4e50ad9fcb8f126bb8d23416b3da7a10c9f9711a	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 6051337e49d6da01	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2512	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2512	iexplore.exe
2512	iexplore.exe
2352	IEXPLORE.EXE
2352	IEXPLORE.EXE
2352	IEXPLORE.EXE
2352	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2512 wrote to memory of 2352	2512	iexplore.exe	30
PID 2512 wrote to memory of 2352	2512	iexplore.exe	30
PID 2512 wrote to memory of 2352	2512	iexplore.exe	30
PID 2512 wrote to memory of 2352	2512	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\4755a3038e2d706b40869b72a207e712_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2512
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2512 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2352

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e3c80525bd80b55a3f406bc413d19a8d

SHA1
a28392e8617ae31ade0b736de54a720e587b57ce

SHA256
6c6ee093d4de8d502291d077590f98104481eb3b54bb957b79eed0f83bd00a71

SHA512
89864b7f884e205eae1d3b6abefbd82fbb3c431217525cc4e2fc25712fda429b67bca2359596bd2672356c589373a91d00dc53a585eec217b8485dca19e3d142

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8cbad9f3c18a42ff3abff7c9c65f736e

SHA1
a67330c148784ea737ebf22be7219b79a8c394d4

SHA256
290d13a13127d67d8a1ec06f97d255e87645533796be6c14db38a85f154e5c58

SHA512
d8ff370ff7e2a39c945a56e8c83fe395a925d34e2535e375252800bbcc5bc076abe70627f5c61b8c0091f41fbad921c9c7d15cff89ea99f6c7469a01174a2dc9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
939ce45234795d9cb02bbfcabb671e7d

SHA1
b82a1c0639243390f07da4384619e12781a9825a

SHA256
059509536b6405abf1286516f825a55e2e81eeea69d0a0f9feca0af00d5e5748

SHA512
905e900d75f455a19f5c4090677c296daeda4e0ac0078978335624ad22668bf70591bbe123fdba28559994e6cf2f8a63db79c50a1923dac180cbc2f7978d3969

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
bae26c73a27b6f4b7971768a256aad86

SHA1
a966d61cac817b8a91af3192c92638b0af308be9

SHA256
2d51a217ab3b51fe7f60ceaea22dd16dea2117da024cbf8a310529b05872c62b

SHA512
df41271424cc731f96c1a52e12a58acc2a080eee5906bbe60cf6973207d5b1e4a8a4d99bf2ca262ef51c2eebc85fe8a8b783267040e906d96699034ad21a6f84

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a93ae18a2889ea879ebff25bf4ec6812

SHA1
3e63ec2d4709c6e71f954c83c6a94ff6aa7ddc25

SHA256
c790dc53057fde4088fc91a074f99b9d50f2deef7befde1d5a39d5838b78f7ca

SHA512
63cced0e011564ce03a0a568b8993f07921ab8697922a6fae72b22bae780810400b8356a58c684dc3c397e57052d3ebe58a547b771e5bc34aa8bc0d0fc43cc39

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ec9f0655509ab1e7028680a0fa29ab0d

SHA1
87b2185ff77bd477b4d8d2a02ba6a433a359b574

SHA256
1724964b3284b99158cb4942c891fcf1874bdb65afb5a1b2ca93187c4b8d9a2c

SHA512
ca2fff9b7612b9bc577b30442d844f506108d6a85dd2564e2899d6646ba5b99be8ced63f825e984630d296c7abcf40395c31aad606f831c75d264a91f0c88a30

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a2a596cf8b0dc22b835b468f2484db4b

SHA1
4076fe33267029c38e6f652ab403487a870587cf

SHA256
89087761036df8d4237a48d710f733ecbdd0dd6b8fc0fdd5395ac52b10193fbf

SHA512
aebc9f1adc3419bdb329db6edc9d5bc862a4d312182704255c515b6c7538bd12842015d0a2ec5b46a4ace24ef8ea465568d4ee95630d43562dd28b841b8ff667

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9b2fa312d46946573f0574931fea965a

SHA1
be5669e7b877ead7b33c71ef1d0f6bfcad69bc81

SHA256
1e1b501dc210252b945b99154c6c9819b9f6c93658cf71a5b30fdf63e5fd5289

SHA512
c3e078c11b27e73bdb747e574b5e04b3629b61ea72ee507f6637da82b93dd018ef39315872581bc0e44bc2d1cf78e3b45dce468ad410ff80fd5a453a7a3eb773

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
592ed9f34b7fff6f72914f5bbca9ea1a

SHA1
1500bbaaf1fedf039206946427f5b5925072f3da

SHA256
4592636346f27fd9de57be07e216546739cb4a62969fe22b42f4e003fba06f54

SHA512
cc5d7e1a108bb5afe7d78e1333cfd37b9d7dacf0d4b657d7bc8eb381cfea015bb32ca5bb0c00da7903831be6345ca0d3e96e8121ba0bd1b33a68aa53c752ac8d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8fed401ce5ebab443e367a2129f39d5e

SHA1
384e46b20a148b55026cb56637367a3dfe720339

SHA256
590b4d8da11a50e3de447b2f5eec79f7190aa87f9658270c04f757e881016652

SHA512
99b1de949911c8d3464bbecd0728236100d65cd7a781c32da58ae4b3b74b692b1ada3aaf920f5495c1dd86c051b1d4d340c5ce770691ab36b4bcda840cf4d278

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\KJ834MBR\1[1].htm

Filesize
114B

MD5
e89f75f918dbdcee28604d4e09dd71d7

SHA1
f9d9055e9878723a12063b47d4a1a5f58c3eb1e9

SHA256
6dc9c7fc93bb488bb0520a6c780a8d3c0fb5486a4711aca49b4c53fac7393023

SHA512
8df0ab2e3679b64a6174deff4259ae5680f88e3ae307e0ea2dfff88ec4ba14f3477c9fe3a5aa5da3a8e857601170a5108ed75f6d6975958ac7a314e4a336aed0

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabC758.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarC7D7.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit