c2cc929e8838eecae23ceaeb23424a2863cd2fb692bb2ec6807f03f7d2ce0308

Analysis

max time kernel
144s
max time network
145s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
14/07/2024, 04:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

4460907a07849d901e72a7405a08308b_JaffaCakes118.html
Size

57KB
MD5

4460907a07849d901e72a7405a08308b
SHA1

323c0a486bbb6e842dd02000e61374be8cd22b98
SHA256

c2cc929e8838eecae23ceaeb23424a2863cd2fb692bb2ec6807f03f7d2ce0308
SHA512

578fb1946b561cd686dbafbd507a6b2621ff3ccab09c7eca027cce115490421a960baf71eafd80fc98e81f8dc77e67eec6fd25bb9baf1b31064bf198da8916be
SSDEEP

1536:ijEQvK8OPHdsAZo2vgyHJv0owbd6zKD6CDK2RVroNNwpDK2RVy:ijnOPHdsp2vgyHJutDK2RVroNNwpDK2m

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 34 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "427094580"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = c0330ea2a9d5da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{BF637A71-419C-11EF-AD83-5E6560CBCC6E} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000082ebb0b9d6f3f0458e93e15bd38f268f00000000020000000000106600000001000020000000d1eb5993452fc2bd168116fec3d8119f0c51d99982300de7fb6e3a0cbebefb48000000000e8000000002000020000000552154b272a766a9a264da3c46cdf7da46521bf65f8b0203f9ba70d8987c554320000000e8a19718cfc5f611e38841ed75205875b4df148889ee009e2bf4a71f39d0eb88400000001d583516b58c11571a403dd36ef269fd5691feeca62cf12dad1dba3bbfa3588ff31c59cae41514a9013a82101fbebbfb4fe94d5d8f4f09472e57abeadd205b20	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000082ebb0b9d6f3f0458e93e15bd38f268f00000000020000000000106600000001000020000000939edc8142ab707f4b53726ca822f78b50f897cb6541d17f5bb168b2bd846f09000000000e8000000002000020000000d80d7f6686bd2b5bc36676ea7f3d1358d4aa5abc71ced532ddcef674dcc0509e90000000bc48da922c2dec472cb1a0fd277c45e6c6ebd4bda640c635429128b9a200675fe328e5f761b17f903d1239e656594af3280770d92200880517937a2596b2704f35b8fd4c4f26bf8047906c8b210a22b2f67ff9550cc5947fc7ed62235216852d258ed62b849ac47e6e8c42af14ec65dd8b18e3515d6071c2f233f1fac8bdd01fd3f28a46f919e9fe31d095747997414e40000000e58aca1a8334dcf7ac5b18e4077e77299dd16b72a0f6331ed20236364bbdaf96ab1b10f831c5e9fc9ba3af4eedcac7c62d7a6e06dfe9d7633a3da96f42e5d2e9	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1688	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1688	iexplore.exe
1688	iexplore.exe
1988	IEXPLORE.EXE
1988	IEXPLORE.EXE
1988	IEXPLORE.EXE
1988	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1688 wrote to memory of 1988	1688	iexplore.exe	30
PID 1688 wrote to memory of 1988	1688	iexplore.exe	30
PID 1688 wrote to memory of 1988	1688	iexplore.exe	30
PID 1688 wrote to memory of 1988	1688	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\4460907a07849d901e72a7405a08308b_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1688
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1688 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1988

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
014b1bb64edb8a67c7dc5ab45e7a35af

SHA1
9b85600cb9dd2172441db7ccfa5a6dac1e871dcf

SHA256
2459ab800bad52b7d9988d60ce4fa1bea2189edaac64c47c9bb5e9cb0ba2a0ce

SHA512
42a9bf547f158eb526688d37a5596fc713cae52169600ad2e6cdcae300e4c75bd8937bedddb95590217a36df12c38bf7cc8ccdbd37487902777f2e5df8baf6a9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b761d6344efd27a63d29b9779253d8f6

SHA1
48ea150913f2c49c809841534622dc0e9fdb6c36

SHA256
67103c0aae18ad30cee1fd3eeb549f1d3fce9482467252f61066c370877b4a44

SHA512
209b1d11bfb4bd1e23f503e26c3360483fd9dd4d5900563516079287aed45d12086a33207479985d4b2c42621a697233f9c836250000b0537bb262186b0d58d2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
acb9bbe85ec56db6e7a366af1340b411

SHA1
956bce927ec711d671681c41acf083a4773cdef2

SHA256
0d4c92b46f85a651d4b487651eb9da86f361a8610bc4f198eb8aa5096c30dcf2

SHA512
2f30cd06aafb015278b2bf6d8224957690494883264b2067f970bb1e41068ae10eb6de3ef00b44a7b86228eed3070f278e80c029946b9530368d6141ebc1fe26

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6615dfb84678678d85966fc1bffdf273

SHA1
9210b438c8eae37618ff2f1b2c106b610f768009

SHA256
9601ee158e5f740f93fcffde02bb61a662c6501b6f2b26a4f2d0f907a420388b

SHA512
01480a10cce4f3914a6d5c2e43a14f7047473c16a535c556bbdb0fad759d294d96a139e86336d18e2224497a607ee5e1665409db986bcf4a91a28b9d5cd9f49e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
bc0622858386d563daaaa0e05f0d8abb

SHA1
0fb140d19495e1c895926feadbcd3727fe20b8a5

SHA256
1fed222e0d418d9341ccf1b0cbda65a62dd441e7b7263f7e26de58a8b3ddabe7

SHA512
04f14a2389d99663c58c67bece227903aab5271f7dbc50bed5b13e788f2da23fdc4ac133b29fc575ceacc55b57f2c7be764aba6fcf77acc7cd1facae2e153e46

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
69085b2505bb84d0ce448420cd81db7b

SHA1
a7c09b6837808c255c010779d186a34b3570d31b

SHA256
a2bb57c351e3f8ee1af6d97bd487a5a74ef91092c3e67a170bb27b0e155d9875

SHA512
60756232b9bf0b7bed285beb0df645bc45ad576fdcad4d456634725833809b117635e2e77a77fc0a1e38e785bce1976829ac1a89d15ba34e3f7c33e575c3a934

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
65ddb2928d89319113f41a57727db91d

SHA1
04d201fe994310166d49c17ed94c4603813ddcab

SHA256
cc6a70b9bffc95187f9cf0057c89a0c6255e88912fb8403b77cc3ec0943f4afb

SHA512
b120133487ae2bbaa8ad601405164ba84a18ad32a416f6d1c9be0fa569fec1678d068ba8f2cf72218404b14d42efe5837d74c902247dd8909f24077a14c910ee

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6c3d33303c280266741e2172fada3410

SHA1
ae10dde4503280e53bdd494008807fd742227c7f

SHA256
9e711cafb95aa225688955e9ecaeff425a6ff3434e45845b1de349fabdae7e6b

SHA512
1680f4fa5dab02dc809e1f12d3be92370d5327394b1fc92decd19d59a925f2771e00cc478b82a1db0f869389f7e8f498df6c18d7698a8d71f9ccdca5737a5741

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
86ef0a196449ea2c623f627d1e23cbc5

SHA1
650d15bf384bf8eccbe9cfc24862fffa6a5e1f2f

SHA256
d63a230bcdf82e52f89e58a45a0fe31bf42342fd37ddb930a6c467c18b9e01ff

SHA512
e1d9989d825d9b1895b480d88a1ae87b6e94a65b6d33020bcf8988da5c44f7d07f5abf36c3882581ff63b144837f7246ba2d8287fad784fbbfd3ef7e73cf3b93

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d558a3da151594fcd3688f5b83fd1970

SHA1
8d3ab4fd71672e5811177035237c87f265f55e8b

SHA256
47d0126a984ffd96708ba2fad9dfeedcab5b7f87f023af482d96e1007ec33712

SHA512
30744b2fd1c9ed02baf27b88e64792f08b5c6b9cb755c510c271c78e8ae3eeed72180b6dcb0cd402fd21915358bb24c5cd486a602548345c70cc08279d271d4d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\M7GT0RRO\f[1].txt

Filesize
40KB

MD5
2abb16c852ee1e640eb438e06223071b

SHA1
6996a5b48d334acccffa8371ae5ca1158021552f

SHA256
9b078bb0f8ec8716877e69839b773e16e9d064ccb401dee5966bab818a22b891

SHA512
2e24e2856b3ee9ad49f6ca4981d4f441c36cfb91cb5b0007d362bd79b8749d9bfb42f9f43c0382be68bab9ba55f6afb9ba6ed99240ab7661d0207bec81402642

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabD77D.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarD9C1.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit