ca595c5b917672d4151eab26943150eb7933d4a85dccc368658eede9b481372e

Analysis

max time kernel
142s
max time network
123s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
14/07/2024, 11:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

45b4fe7f1c99137fc130209203b25caf_JaffaCakes118.html
Size

11KB
MD5

45b4fe7f1c99137fc130209203b25caf
SHA1

200d7d92367b2cc5fff4f7e3d612cacd13c65bd8
SHA256

ca595c5b917672d4151eab26943150eb7933d4a85dccc368658eede9b481372e
SHA512

8640650ad62b9f8e44dc5c9d083b51ca2c25e45b43307c2de645c6509fb0211bf313075f17bbcbb21f7dea090d172538fb93d5970389fb85e25adfcb745001fe
SSDEEP

192:2ValIsr0r57MmxxT8+/w1wvqa1pgOXuBuLbdU8d:salIcIQmxZ/ggpgOXguLZ

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{FB67D9E1-41D7-11EF-80ED-4625F4E6DDF6} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000062974e5b5f804e45b98349be16bffb7800000000020000000000106600000001000020000000b0da03d40cf3c85e1bac8070d28bb84158fe587cfb170cbf61a00b5f2a43c8fe000000000e8000000002000020000000c0e5dc66bdf1bd75d3ec259b7cd146e1f20e4fb63cd1d40d5f237a4ad4bda5a7200000006d09a5eda2c9a38d4ae0c1d0310a00d1dc3846b34dd8a73e8ff259fdd2cc55ac40000000210be261d9c84012d4010ee0eb2fbc1424e4de7cfaee12ee69a4a9cff7d07f4b1b510f4395940f69ca15073ec69d455e6b8f3dc7fb1e5722066dd22fdb90b12a	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "427120004"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = d0a9b812e5d5da01	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000062974e5b5f804e45b98349be16bffb780000000002000000000010660000000100002000000028686a973fe491b36b957e05f2fd85df13ada225872549e836b81274435d88cc000000000e8000000002000020000000109161931c4d936b248a90a0fe609b53562a96d4661d026d5437220fccc68b6990000000a5eb21a26ab87544b868519c9c81e4b33f6321b02654a621551f2bd5f1fd36d815f20606d3c3b86002dc22d515a278115374a8e89c33bfdfca28c94d968da8cb6d2dfacbe9959035f20de133f5e511a568bbf48d5f7fec40a45c9b33508f6f2aa98c894d1f40a059241675d1026d6189298e3e0a1d963896f2da1b291996a2815ef579417f6e3ac4f579d97b1b1878f240000000d07a96115cd3618f41e96ff3df8f56f7f1c78b614535b9e43f29c4f1041a2ac02eafa91438431bcde99161a1e625a6c5fd74cb9b69efcea300d4b43085aca807	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2792	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2792	iexplore.exe
2792	iexplore.exe
2708	IEXPLORE.EXE
2708	IEXPLORE.EXE
2708	IEXPLORE.EXE
2708	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2792 wrote to memory of 2708	2792	iexplore.exe	30
PID 2792 wrote to memory of 2708	2792	iexplore.exe	30
PID 2792 wrote to memory of 2708	2792	iexplore.exe	30
PID 2792 wrote to memory of 2708	2792	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\45b4fe7f1c99137fc130209203b25caf_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2792
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2792 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2708

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8665ef5b0194ae9e3f8e73aaafecf55c

SHA1
c9cf26365445ac9ab7e90f486f8189dfd8746104

SHA256
6b1cb9e02a7aa7e9552c512a26e3610ed704fa9ee1b8529f1b0bb9d3d5c9195d

SHA512
3bab8afa3399155a22e2a562e4ac38a533baa42699771af202e44678e23f688b22310e8bcc94ae161631b4fb149445e42f36e47b6b6c0e81c6de744fa74d09bd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
063b07398f26ff45525b2dfbe4c463ed

SHA1
556a466bc807e5e863feb07fe69130930bf89b0d

SHA256
e1b084e16e22780f61f01394aaf1aaa63d2339cbbfcbfbfb44f070c38243b585

SHA512
74b82c0a43ba35ff19b1f5b3eddb0553db5cae5c4a0910f9bc76937a01aa8bd8f15cb928461963cdaf9cc4393cb4986f999c6090ce7f24819df4080bb88f1499

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3faeb1e997d82bd0f7313fef314e5611

SHA1
0711d09e90afff10f0153dee70db4676b3bd7d28

SHA256
d75f225f93b2225a4b6f86068d3bb53cbb995fe35e5416e239288e04afbb93ce

SHA512
797c29d62e982173560dc48a4639198fccf5d970f90b737ca915477053076d7935f45e4a97d3eb74015e0afba7e7cb76fcbf206c216fae74774e94c19fa44e7d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d7e6dd63c3b28d3adbe784894abcc354

SHA1
ea5fba8316992649ee5569b06e0742286d680e0a

SHA256
6f6ff89fb966aa75b02de92919eacb99d4e732b914f4b82a9d265ac099e4a22e

SHA512
b24078be64949440ef3cdad24e1460f9281b010385d2542ea241596fcdd07be599162192ba7881a2ba21e9e12fce807ca488ba2c524fd13ba1c1f17f55cbd0b7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9869ccb514e5da5946032f2233f304c2

SHA1
7eb87e69a153238fc8952fc4d468032f142f0f24

SHA256
c444c61598c2337b077dbd67a4ce042c120f1d8f1a38a0261153e62c704d4ec2

SHA512
5d6ccfebec20de68205c86efc18de4f4f4212e9b3907a623a7f7467ba97ea9377067c6eb71a54c482fe0ca6c1cd411acad8d81263946cc0e9765463317c48b52

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a4c384422a39b25994e57501293c52da

SHA1
d42a1bfcff0013523816d76b3879293ba6608f42

SHA256
bf71189dd9220d8514c48b99141901309ed57d4724a28d440ead6257e7f459ec

SHA512
f53848b559f27fd91927ff871a6f72d13cc84d0e484984a615afa8f65d7ee5e5f84f13c58365eaec2beba5f7303dd737cd63d511a85c173eeec2c00098827773

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
615c40f99a25d1ac68cc08e228860714

SHA1
dea664d8798a6aa51c287da071d838b3fb8b1a20

SHA256
227a827a5676ba31851a19dfd985f4d3100672c116dc45e2e1e16ca8ac6991d4

SHA512
e1b84b483a5b2eff7431ead1a064178ab35594165caeaad5139330968ee79b051beb6ddbc16b6e94bc994da3c3c0297cbc2b867cca6bbefba42766e60562219f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c9215f93e57b0d1ecda7e1d539146cc7

SHA1
69d5fcf97036506ae874d1f0d2502d490b926f6e

SHA256
97f35dcbd00707254bbae90aed8b52af48d908e1f5e12020c9fe908b91844170

SHA512
52501dda2d4553cb1b3ce6254e59c31c8d0f3f157dfc8a825214e8026206e0d1c7bb95700e4e560660a7bd70c1875837dd84fc0bfda3d03056ae76519454b8fe

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
28ce2804b4cda06aa5447e9abf33f59a

SHA1
26f53acf5c0d52d31211e6a3133664e27d17ab4f

SHA256
f5a784c93f8aded49cf122124092cb4d235c3562710c31b605a34a9e0c693bfb

SHA512
0ff052d0fd492e536af1f85e2607cf878dc56dba12c20f5240b630ae1f7cf5ff411ecc97dd065785b2dce38e57de27c799f025e607045eb0a63798a499fbd054

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1404c41c46350e8d9783342e2ae9e1ab

SHA1
0e8fd1efc8a7e26e9844e197f58bb99895bdb083

SHA256
3df462f21ba6d16cfd83abeed5acff5344d7aa366a4632b77a65061e2f2dfc27

SHA512
d4a698816b0cec487bacd24e217acd575532a05345e1e60eb70a7c61949657b51f5b375706c189854f79639388a58ee8ef528fda7dbf6dd2f30e1db8fbce613a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4545683c2931a4ee2f9b905eb257b6fc

SHA1
b84b412d6c1dfccb7364ba44fffc6166e4efb362

SHA256
cf5a93545e017b0490b2677450c6fb3d81dc7f7bce486b71b6e0f85ada339f38

SHA512
38aee71dd8d5c3b08997cb09a226651b1a9d2cd2aa75ceb736c3a82112661cb552de81e410e4f2eb2d8d5e4254e23665e1f2de3ccbee0a73fd58b692795b68e5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b749af5ee7a2f6b258d7345061790553

SHA1
494c6aa55f002546f0807e6f91aa703efc5f93f2

SHA256
11bac5d1283cd5b3c78f85268d467713aa80145d11451d8027825cc3aa7b2664

SHA512
bb02ed942eb1835cd268be4f1e8275a5a4fb2843ae3857d9627a1deea25d933e4acade164fa5cab5394753ebe6465291120d35b1e920cf5e7f25bbde68c355c4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
297ae127e585f376df9115db699f0fa3

SHA1
cc20a37b007fbf0677d3542d96b54b11e6c79367

SHA256
1081a7898053520b489aef9a69e9fd01b0ad857fd534fbece9e81cfbd763c683

SHA512
497dd9a32ee740ab075138e57baba67578f03411fad179448ac0b65a4b30760d43fbc96020f6c7e32b6ffbf71994ba459ceaa83fb612fd7ee156a34c25c7192f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7ea69a148868067b7a604a25c86548e9

SHA1
bddc99c75cc2ddfe880c549994ada9fbcdefe170

SHA256
3b9ad0a855e60babcc339bf144d56ba58b926455ce3ef4fae1e053ec441bab10

SHA512
8c00057727175354b3a7eb6491d9b11e58c475751dee469969d912924c6771e036e7bdb856571ac0befcff655f44d8ca73b738c0509cda5fe72d6b44ad8ede01

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b4b06c311a2ce9ab520aa9d8b510816a

SHA1
d2e67decc3d2026517f78cde52811236a9af2fb4

SHA256
fee0bca00ef4160e9f71eb5de6f2c4042cab4b3d24f37a39852b5a3c3d9394a5

SHA512
e0688901f4f7c4e66f90201d571de12fc41024e49b799d7064723b87978d938e14e05a8ae04208ca479307ffda44b4277765dcb0f6ea80121a818b751cc3366e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4696c38e5ffbcac7fc6b45f2a8237286

SHA1
322f76f505da017c4673381ece81414d8275ab22

SHA256
eb35ed09d5eeea0d153cb71b995855355b761f476f8eb25718f27890148f394a

SHA512
15fa495ae187a2cc43abbdf0cc6f11aea1d0ce8d62d5716bd8866a5b384aa1a34f50b914bf332f517b640d156fd87b8da2c2a28edcd8144c111c01762ec89054

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5b525bb506ff5ba71fb3cb8ad069a4d5

SHA1
4f9f6d151aa09bf9c690473b01e88ff65d267c92

SHA256
21c5e0b87193fd379705720ed3af959244ef754efa31d038c9741bb6c6b3b725

SHA512
d155fd5cbb26973bce21cc08a891cca3eb441f17e5ce56bee18ac06d6c83e01987c2817d7beea724e3173081ac4745510b440f7130d8b96e211216d73fd3214d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab2732.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar2792.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit