b2fff5dcc347224a0e677ca2f809f1830c33cc3b56dce742951aa1e37fc0f23e

Analysis

max time kernel
70s
max time network
134s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
14/07/2024, 13:55

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

461b617ad67dc543b1037edde404fb72_JaffaCakes118.html
Size

62KB
MD5

461b617ad67dc543b1037edde404fb72
SHA1

e1ccfa412e3dd90ae9a3bcb142e46fb3cf71eb9a
SHA256

b2fff5dcc347224a0e677ca2f809f1830c33cc3b56dce742951aa1e37fc0f23e
SHA512

5d637c8b709f0d10788f16299ad759e5c05822e9b20bd6b68fde43d52a6f01efee1d2a8d3b0d92eb703683e68777a8aff9c97c8f5ee2e286527c2ef3e1c4e575
SSDEEP

1536:ExHR+Rg/juVuyw3FvPTQCl3R3ugxKZfBCB8BkB/BmB9JBLBlxwIqFbuFqNzpvo5c:Q

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = c0941089f5d5da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bb7c5835718279428690b074aa627b700000000002000000000010660000000100002000000036d28ed7816112b6eed2648a3e8281fb0b2452ec4ee121b07f3755f8c4bf582c000000000e800000000200002000000058c55d63e711b66faabc9f6b5295ebefb8e49e8db7d424f94cad957f2c4ceb919000000097077e0ae1d412e1de5273cb6ba655e7c5f1a10394ad36dedb900012ad203fcc5909cd443dd7c020d0afe35c2aad898b5390ce14be8599bdf102fbf39036188fcea0398ccd877a6312815712f832050782793164dec54766973f6cdd9b29808f677d184b6ef60dd1757fbf6a1a2613398afae174c58acca8b3e7330d13b29e19318166e4160756c7837bc9d55f1f259340000000cf84ece211e70ce032a9598bec05720878969efaa767622fbaeebc99b8968632c7b08a720258283a80e0e0e7c4f111a3d6c09904929cb6bfabffa8ec63f5872e	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{B39E12D1-41E8-11EF-920C-D692ACB8436A} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bb7c5835718279428690b074aa627b70000000000200000000001066000000010000200000006bdd2419da285f58a1a3516e2697b754564df19407fa1d98efd6af898bf667d0000000000e800000000200002000000056666cb9d8afef2eb98a6e3a4361c1b97e5cc73d434b552260d1e3fed98684762000000041f645eee81e6e22365240c1ba53897c924881a999a9589939106c72d3b9b3e4400000009300eef27a735cc107687104b7e7e80536ec5e883d194424822881c3dbedb9b2c1439a02d2f3d3ad4e0f3c1bd8f86e8b3bc800d05f9c5912cc821db98d0ce0f4	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "427127188"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2540	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2540	iexplore.exe
2540	iexplore.exe
2700	IEXPLORE.EXE
2700	IEXPLORE.EXE
2700	IEXPLORE.EXE
2700	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2540 wrote to memory of 2700	2540	iexplore.exe	29
PID 2540 wrote to memory of 2700	2540	iexplore.exe	29
PID 2540 wrote to memory of 2700	2540	iexplore.exe	29
PID 2540 wrote to memory of 2700	2540	iexplore.exe	29

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\461b617ad67dc543b1037edde404fb72_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2540
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2540 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2700

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
aafd7fd3eb67c1a5d0bd47989a94e94a

SHA1
e04fc8c98cfe972c01d00ef0538c02cd7ab0f481

SHA256
1b2c4506f0738b12ecc22ee8464b9ffcf45f36ba75254cf258f3f41a953f0207

SHA512
ca1e44441fc4acc2ff899e1540832d8a7420b48f1e42ba34acd414d57e54b1879a4f906bd23e7606403789c6db478a927d0c67461d71946c20f5283edc30842c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3c2d8cbb5cd45a036c1f4983bc9b1329

SHA1
9b5630cb21be5e3a7f542bb3f1a17b8cced037f0

SHA256
75cfff6d35392ee5b6876205577070c41ece3dfa9217bcaf16bc133361e6178f

SHA512
0623a161995366350a391b430c5ac33258672fc94c2853369bd77c43539e8f4c86da3a943fa07c127aa2a538f23353560977256c2b25c71e666e56d4cfa48f70

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f6a5677430f3af62f4a6ec9ad75a2c02

SHA1
61ef145c78d0862531ba49b2ac63ffe774a88681

SHA256
9dcaf84dc441e98b288cca78cb6ded89435dde6c6c48ea35f4776ac59b9efcec

SHA512
609281356115d2e474f690dc0d5d83020f2cbf1416db145eefc216be6f0e2113392a80b8a880a8642168da73f726f78ca485578bbea7430458389b545a6ef560

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
40a3a9b10555f5bfd52eeb45fb2d2b7f

SHA1
1bb3b6aa2023807e635612bf81d17452b60add63

SHA256
db71f633b77606987498ec9f25b4a04aea06d3f897422668b1e329f9b213ea6a

SHA512
cead95e9a4492b3fc45c980bf6499fbeea88eb9745cb25a1a4b339680cee5b88d6622cbb6033f3fc4fc51f5dec3dfec791542c9ccb0fd0b26a67a78fe1d7e036

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4b5b5a2ed107949d624a04c4cd411cee

SHA1
c4c5e4613866dff6c5a36b6d9aa3eef41d00208c

SHA256
c5bcd02e72c0d0709e8c3b945f7aa819df1b6b02a3f0279c3bbcbbe5edb837ef

SHA512
626d893e7800921ee344b99796871fe9c1f366bdd658fdb8bb5a2de213dcd0365879c80c883ca3963f8f15b6236e0a732a78e7b02881c34b449acdda1ba6e26b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ccce54d903809eb4f0fa9e17c009f6b2

SHA1
274b9d6e8cc63257f5425b5a9a20bf3e7821c29c

SHA256
839321b32c0af288daecd4375e25e928915dec7046de6ceae42773b8e917a94d

SHA512
d4b65bab10038a108464eacea609affbb8ec922ec77c652945d1ba8b0b57734ae461943e2b440ffbc84691688f32c8062fd6a807ba05806ccf593be039fe178b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f7cb10fa93e31eb8040b81f6f6567c78

SHA1
7a353d16f9ca2b764be0bb337a1472213b6381c4

SHA256
0abf929998313271722d5ebd416ec4a09de4812e38acc7ad2c728bce13fe6706

SHA512
bb531cd18f8f1fd15c8cbff26f3c9e1f8a268c08ab2cdc9887ee824ae95f7bb05a08e3cfb657a50d2e3f0dcb519d8f83e823c29d0c3e70f347f71ec399c4a367

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0838e8b95e96fa5b18e8621d6666abc9

SHA1
a9610f9d9ec7835b489eedb38c9ae2db441795b9

SHA256
b0d89ec6762432cca01a81113a56a98eba05221de107901f91f7de385c935fe7

SHA512
888cc577c0ce03b4ef0816bbde783ba1f47a366ddba2714b89c3dd9d712ee6e55c699f07f6a6d46c1b8a718d86146bfa9bbb25fd7a74e5f39e656c411e025038

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
fbc17ab47c76bc504d6f00101dd1ad62

SHA1
f6023cd7555375b938b340fd60ae8300e9af1b41

SHA256
af1fb743d04fb7c9114ab480f18e1ddacf565c5abf7fe4b8d3f35e3cedfd5f59

SHA512
466d143cf128722a8c93f0c4c450bba0c6ff3280fb976969f66a3af1d2c30961f9d238c161b4643836abfdb8515c2c9d1fe6d292a80a4ec5e4f80958ce9965d0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7b2a1ff974e15669b5d2cbc493921c50

SHA1
d43512cf1ff352d47bbcf665d9bd003109bd3e30

SHA256
585c3b7741c6400cfa3bfab46f847201f13ed556223c8e49053db223546e9a8d

SHA512
0d7cdc73522efbb7c034666fa7d55a51e6ec43582387865c08fc4a0a67ac8379d7f61ae1c6969a89fa344052c962d0544f51aa07c3c83f504dab19534474e9be

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab29B2.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar2A80.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit