509dec9ff997ee9cf414474ce82ceb79ce960eaef5a001134765502ee5958430

Analysis

max time kernel
135s
max time network
129s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
14/07/2024, 13:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

460a4f18dd4022f16bab76adc9651c08_JaffaCakes118.html
Size

24KB
MD5

460a4f18dd4022f16bab76adc9651c08
SHA1

bd395fcb846eb923619f3777368745ff2158973c
SHA256

509dec9ff997ee9cf414474ce82ceb79ce960eaef5a001134765502ee5958430
SHA512

a249b794f30acb47acc871821ec2102955d4f58e760ef2a72bb9c2f65937ba20e5646a42d0d1929e0a0b12589d34dea07b2d2f02d85448adf2e48dbdf429ea3e
SSDEEP

768:H4CEGqSITgvW6a1Q0ZlzNZy/8uwWLTN6h/nhht:H4PGkcvW049N0EuRAh/nhht

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000930ed985b08cdd4cb38e38023150682b00000000020000000000106600000001000020000000ba0bffd2ff8145f35275e75049f9dc856c68baefb154007a7083bc65834df524000000000e8000000002000020000000601ef56b9201e1d91b8616b0d8ed3253e0eff1a82fa7a50772b63e068fa84d7c90000000774c14d3e0cff461d1c1945f6f6bac27eddad8e27ae55b36e89b46028ea2214a624325ef299f5b6ef1a58239d66576acaae044a9da4d12fd69ff1db39aa94cba1540ddcbe1d09ca41f716cd898fa483dc2e64320babf0a4a67955c44bda103712a3323ec6aa54932d897b2b374b307f621019d8079e5ec11b2e352ae57814328fc5bcb2d031b2c3b42c0ba4044e07a8d400000001ee1d4261c01efee9660e4e14626be8e12e698a8421456dc38ec9ea083305c1b7c0b2a2ca8972297bef4177b43b212961c7240c61bb8350ad2ef2856f70a0e53	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000930ed985b08cdd4cb38e38023150682b00000000020000000000106600000001000020000000b7a5e4351db04cee0f94638fc5a830fb6a6fe3a222dcdb9b1077c8f6d2b93ede000000000e80000000020000200000005203beea8cce2884fe51b309ed691701fda4c5037a69a2dbdc3d9ea2a25da77d200000000f4e452fc5844d7d4ae450b046ae9e803f25ccb7137c0e9212a10aa9639b9f9140000000142de9d286b9ef72e690ed03e87c815e7ab2e149b4b775cf0765f2c8831ea7e75dee5a6aeba7da2cf289e60e050b221c15cdbb0d1feb6e5809843cba5f9bea2c	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = e00f9ab7f2d5da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{E2F73231-41E5-11EF-91C9-6AF53BBB81F8} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "427125978"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2156	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2156	iexplore.exe
2156	iexplore.exe
2856	IEXPLORE.EXE
2856	IEXPLORE.EXE
2856	IEXPLORE.EXE
2856	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2156 wrote to memory of 2856	2156	iexplore.exe	30
PID 2156 wrote to memory of 2856	2156	iexplore.exe	30
PID 2156 wrote to memory of 2856	2156	iexplore.exe	30
PID 2156 wrote to memory of 2856	2156	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\460a4f18dd4022f16bab76adc9651c08_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2156
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2156 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2856

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0efa38b1613f55a82b992f15b0d0a3a7

SHA1
06d7e048c2d8af36349133fece05e1fe72c529a0

SHA256
70fb809ee6a980d25b5b5c5fec5751b996dc7214f64ad3eeddcc79356ca2e528

SHA512
96d89fdbdbf794d57eef35ffec46d276cf689c386c39fda4c411ebd2f58b09305255e5e1d5d148b013f3a1ac881a9d63e36b733b9d590af77b1ad9bb3ddcb6ee

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
07cc925c9213abe63ed7036cc8efa1b5

SHA1
2e9a4ef2a51c1483d224c4d27c388984bfa3b740

SHA256
6af4f1bf0a71a32df306a10281464aedabe6560016aa1aa4024213c433de27a9

SHA512
3af7f6c16fabfdd2244356577e1f6486d1bf7e15c49685294706bb5cde5075f236380b51ebda10901628d755c50255442b73e0df8fe2fe4c9ee401575b4fa4d1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
414142665201bb9e47f9c9b428305408

SHA1
359f7c07735317c7f826b6098fd1d93ba5ecadeb

SHA256
ff030add33a2c21ff734c35238a971d18e0e0113032b835a11eea1aa763c0064

SHA512
27054b05571bf09740d238da3655923156404fc62fb05c4073fb42230129e45e4c5e56ce135811ddc3a8479c50cd581d96125b13981154e9c5b5cc8aadd009a4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d25b3330cff81bf983ff9cc52debb58d

SHA1
bd6ac026bcf2cb75e1544384bb1dafc5c6d392c5

SHA256
61a10ca17a79538a40b63ba2abe55d6b33636e66bbda1144049ed63d08deadcc

SHA512
5f574b3daff8e689190f7f00aa66736eb0f53b398a1d4decf6bae019820e80b969e88423b3d17fc2d334e2d52d05d714aa249ba5befe6842afa86d670847298e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
18caf4f9ebe1431b087f511142e13e5c

SHA1
7b933027449d05d35faaab3453a55ab2b1487cf2

SHA256
ca93c3c203724b766141882598d7c72cada2e5a4d857c602ad4ecdd9216c897f

SHA512
1ea44414dc00a6f51d3d7570361c927571240a25e71b453e7812b1f1bfdf2401d0d6a9224afe73a84f852658c554dcf1883bd5fb2487dcca1339e0fc6a7125dc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5d2a30f4770f01f6b8e573a84d1e6eec

SHA1
7bb64309e0a72a9451e5b089a696916c73ad1f74

SHA256
7a813ccd3b7facc90b158ba551589911461c16081d8aace2d23bb75fbaca5991

SHA512
aeea534e361239355f30872d5d08c725abf3d073caeda064853c642fc20807b0f151d0defd49b7784d2f9be55001e6c31fee9927dacb4b2ac2d0e56d051c74f3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
457b2588822b59717b82f9680312f8ed

SHA1
376621070e908a3c91c72ac975ba6ca831100966

SHA256
f15ef5631e9c780c9bcce66e747ab4b22e65d0018e30d950d82101c8d04fc6dc

SHA512
331190d510f3699ae8e557260830e36049f05a13c9d6a1fd7a8fa75fca6fef64621a7addc6d66aec124c5a490aa0e7ad576071e204b8dede805d0ca7fcc38bc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
eca20c5231bc00638fd3c6972be4abf5

SHA1
bacba60a5cff60793d778d1842f8b07539811168

SHA256
d3570779d88eaa1078366164b7d3646c3c885f8e632de2265d53edfff2f01a8b

SHA512
d75837bdbe7a43e0ce558eca6f1cf27d66674323f4a20fc777a25e5711cd67d8f01fedb3413ef4e5b6619261122206f4321b77243404243dc8db814734eb7353

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
baa91b3496a8995c14ed5399cc40d4c9

SHA1
8b3715c0eae22988b94c1ce679c465e7e86b460d

SHA256
e4a55f183c11cecfd2cb0359264e3f6372addaedd89a570ed97fbc86c7842ee1

SHA512
e722cfce186ee32dd84eef40f3037443778b81497caea490a36a1570294d78ba86917e4acf137d0ef499ce20e3dffab742e45d69269716fc24d6628f30233990

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0932a18879deda95e836ca5cfa5af793

SHA1
6a2e8b455daecd3e085906626cb0d38ec5dbe812

SHA256
3c6606989fd2c3e68e1f8b4e64e0b9fe1e17c7e13d186ad0e662ae9b2d0d6144

SHA512
429784a4dc3c0e39c24bb222a9ae9462f283a8658f0e1c5f9709b6ec60236f503a0cf0eb731effd575be16b293fbb72ded650ae07b350b651fd2b5bd962cc13d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6f7e121c70bc34412d57095c4e062ced

SHA1
094a50ca0d1a7786d0043a23a43e413f501501b1

SHA256
13bef5208039a494116cce7586e0ff67ef61c3e22d60bbb3ebd4590d9587820b

SHA512
08c45c33d50c570adb067f5094a6123e29fbd124db0e83398af8357d1e4d47f4e2a240fdcf19746eafa5fb70ade547937afae912b55ef0381e58bb14df2db172

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ea1409b984b89fb1e5acbfd984bbe112

SHA1
269c2e1eae517975d8388e5d07f1fbc517ec54c4

SHA256
e2dff11faa2028a28909ba6288baeb5c38e2ab25d1a23245d91eab0029b3d5c5

SHA512
3408fca9eccdce93f20c899cce98ec669f09842e2457adbaa917c967d13547e82e5370514cb7815eece640f19827d92ea2245887d9130e2f7c189d88a8dbe9cc

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab3C58.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar3CC8.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit