539b90467926725262ddf71a1aaa3e7c6bf50f1ff19c65dd42297269f740e0d6

Analysis

max time kernel
121s
max time network
132s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
15/07/2024, 00:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

475b867be332bd2e94e212e9a9057782_JaffaCakes118.html
Size

119KB
MD5

475b867be332bd2e94e212e9a9057782
SHA1

6920d265acf704035b26d653281b02543c2e45fe
SHA256

539b90467926725262ddf71a1aaa3e7c6bf50f1ff19c65dd42297269f740e0d6
SHA512

5be4479c6113cc3dd54ab64ad8b15275ea1b9d5124acbaa5a6398e3211699b0be1a5011995eea791f9d0866d807021e8017e4becb85df926b4685aaccb3f4255
SSDEEP

768:QxnXAt++RJvepSklvUdA5xQS+g3wzCQTmhc4OAz/CxUaf1syMp6rWny:QVWtaSSAAangMFA2ZV1sTpEWy

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 34 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000062974e5b5f804e45b98349be16bffb78000000000200000000001066000000010000200000005aa3cd48ce9bf6bc70b808ab81ac6ba1375794f3c60831239fc54969f8f7ccec000000000e8000000002000020000000ce33dc857ffcd8affbc63b2f3bdff232733be9e994779fb708288cf94ecdd838900000004682e32d6244e05a070997405ea5b00a9eff6551a6a5f58e324ecf431e29f1e3d541ff4f21c5805b6f9d89140521083ce49f8202daba26ae5774213eded4b325f40d3c740b4c4bb56a04dbe7ab8f7cbadad353190e3f66491ee0f812828bcf36c0e9fa971b7878acf29c39ac8e30606ff036455a009e797206d2e7f65beeade68a4e36d0bd818a9ff3372f90d9c86ac8400000009b4a529e13927121b4edef9bae685625350959194dc9725a895b3b82da7b133b35d723f203b9730d29734bd613b6340815d52f733e6ee65e8f14c2e5a8cd3bc3	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "427163678"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{ABE49001-423D-11EF-BEDD-4E66A3E0FBF8} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000062974e5b5f804e45b98349be16bffb78000000000200000000001066000000010000200000005bfea8992a40d701dc08cc9cebcf3fd87696cad8fb6680f379b1e4554eb01046000000000e80000000020000200000007d64db97376fbbf085d028bcbc2b5d15cc9bf8993ca671e084c5869d615cb83d20000000bd549619b5cc6bee0bf77d8cd9ab7ec86517eb5fdda68646c17fdae78cb706b040000000e91a94badb711b08cee51ba08fbfd2895b889323a50b74a68b755794ba930758685ac7b22a0a177f2b74e01975012f09617842674ab28fada7b4912075c90d65	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = b0e845924ad6da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2628	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2628	iexplore.exe
2628	iexplore.exe
1524	IEXPLORE.EXE
1524	IEXPLORE.EXE
1524	IEXPLORE.EXE
1524	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2628 wrote to memory of 1524	2628	iexplore.exe	31
PID 2628 wrote to memory of 1524	2628	iexplore.exe	31
PID 2628 wrote to memory of 1524	2628	iexplore.exe	31
PID 2628 wrote to memory of 1524	2628	iexplore.exe	31

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\475b867be332bd2e94e212e9a9057782_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2628
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2628 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1524

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5d4f67b4727f3f454143a6e2dbcce836

SHA1
b469998a057b8290cb7317e6a8ed84288e5af9d7

SHA256
b4ab2f3478511fc4c7dd3171e89408125cfa34bef741a9ca2690a2b63913dc60

SHA512
221b081ca14b14409ee62ba3fd53bd2df2e386b87f53e3a87b0e28c5d504e7bdae4653c2e8b3015040119c5c5e7559bfbed8610524cd47b0eeb8bc30d455711c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c79385c7cc049131050af452725185dd

SHA1
7283571ac6bd659e5a9431d8a08cd9649d26a74c

SHA256
c48cc6a6bc77628118ddd486862da2d67becdf2ce1c0cdb75a97b6d1f24a85d9

SHA512
fbd4f58ddd847043ff6248dfdbba68ada3de19b3f581171413e052e2351545fcb0bf9a9b9526f31d05170db4a19dd1f0eeec5c8a8167599f233a1ad3795f88e5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1174d8a1597e91f5bbf745db4f8260fa

SHA1
cd50742a4391a4973535508cdd6823b0b0025349

SHA256
2c2323b0cf2c2e143ad2d4fd9496ce8f9fb0773c96ccfd1aba27aecacbbf2d57

SHA512
8cd0563ba36334ffd7a873941d12ec48c7c1f53ff0a3769ea458d5e5097572fd59e82ca8bdf02443b7f71cd9f10fa8107b945ee66840a344e86c56b4685cfccd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7362c53abbe1acd220ae4e7e91894164

SHA1
d8285806d8a459d799697fc671f14b3f477d52b8

SHA256
ed09218b5fe8a5e3d7e026a7f241e08a8914a296294760996f9ad09fb42f0165

SHA512
1f19fd8927e5a40d47cd353cc85d2e9bd08c402cc45df711adab39289b3a8f14b7e713686bcddd30605c95547b56acfce7c92fd6855a05b8c2f3acbb196e6c5e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
66f08543d22ea195bbba6b2f414f9e7d

SHA1
e3e23c040d54a979299eed2d890347f0ee1a3c69

SHA256
57de05df3ea05b6856a6e9d4c67530ce21f60e844fb9a7dee420c19e03b31a54

SHA512
1e50a39e48a3bd7296370a2aa5ee16cf080901807c3518825fe68e89d27ba4f6de10ca00344dae9a8a54ac339cb4bf1eea44e84157aeb356f9a92e8e1ed46463

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
dd9aca261f5d979ac8084c5994e0c984

SHA1
efd1d32775abc6ab9a3719f59519d543cb8e914c

SHA256
ac7b009030caba7ffb41f401dc4fb9b19b358d6ed284e1db2da1ccb80e525f06

SHA512
6385160c57a8a1d259d24d0639a8d019013b3fb2307fa6bc4cbf600f30439843acd832a96476710acfbb56ef1b4d791b95cad9884cc7e8ef1d32e5bcbf78b552

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8de1e31dc4b6f267405c56f432d491d8

SHA1
831428ecec70877d00aadbcd5325de01ff0f82b6

SHA256
33fa9448d91b1c1d155ec0110cce52885ceac8e6ebe96486306c687752889b23

SHA512
a0eea6610a8e6b598a99d7f37c415935f4298e54e28280bad663d08a2c76713df4a212a8da15496bf922a75753cedfd2509e64b7f4ef128ca2ca17816bc199c4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c0e4a54c391cb50fdff0182f4fbd8653

SHA1
fa1efe70e2812d022358798b382a6e015c660e90

SHA256
c27c02722ee69bce13c028cc56f9f780d7c8366486e19677bb394250be1ec588

SHA512
79c6824385256c676be7119c4a718fc5d5b7b604b2d35b1bc16e1ce061c9643fe8e2001577ca05a68e918937bab48e3d171519c87fbc5f6f745b3d859b3c352d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0926171533ac032a55440cc1cabd355c

SHA1
d5850ca28a3398b613b65860ab90873cc4d86c72

SHA256
53f8449dd49caebcd0996ebf050ee4d1631c7206292f52a505d78bb853192bab

SHA512
f0686f4e5c8af7d5cab600d53e1822ca32069d43da82bcbd54acd1c8fba905cd936795378f1a97d01d609e4f732d332cc2c801e21bb5d1dac36d1c9668da935f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3f7ce0b55dae538d27b4bcbf633d0c24

SHA1
0b852f4728a42f4447ba5c8bd8b37ef16898485e

SHA256
58db5535111ffcb4641e1cbb8c19204547ee58d9b2ce5533ef9fb6fbe0f0ab55

SHA512
2211f72dc67ece6dfa290f89e2c75d6be667ec0d8c449557c9861909dcfe033f1765e08603f71800747ae46d0f4003ba0ab988c8a1c8a6fee4cd86130e5ba4de

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
251c20f6e116ec8b27957c98663cf5a5

SHA1
0b8892158c996c237b54cdaf467ba94ac20d1a3d

SHA256
a62c2f5666c07c7aca783345b56e12e1adad8ddd16d5e043a193d667fada0fe1

SHA512
5176afd876fe65a64191fbbdee4f126774e14ffacc213593a312b4438f7846ecef2d02ae6c9f801d4ec78a903e24a3dae7c5e97c0fa32a8ed6ca7fed4f442833

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
51fa2af3c3821d806fe15c98464fdd84

SHA1
c89d08e7ba664ab98cbbaa1ccf791f2f4eda8bec

SHA256
0366c28616aa64fe62c0142ea6767e32ec7baf3187d560a4022b5857b876df0f

SHA512
0e8787ded86ca1adff03ca371c443ffc50635f99db075592c4ea6d877867cb67e6127fae4d0e6751005270053d46891555904b8f97915e20303fc75177a40ddb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7642f780c754dc6248a77438ee94275a

SHA1
0c908988fe7230789e3391666ee7f27c2f4f5f4c

SHA256
c054aa0999510dabd5c2e7542fd512bf7edb55d86828a71835e7f6abc0fa9bf1

SHA512
58d1fa15f4e5aecd35f7255f87a300025ff42ab31bc7c513eb0d51b03fc1426375e963e31ef4070473dbb9e1c63b9926069846eb86a6bc221577031219dd7747

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a0ac69bfde4859bcd4c6de8b993ea651

SHA1
8277be64b6799e0bb52374e193d1c0b0b2e8f5bc

SHA256
fbfd6c1ebe66cbe5335b7417b28321e20aa6001ebdac0bd207ea3c3838291274

SHA512
a1143a5796d43b8ed677cc1ee00ccbe89ddcf7da61789d651eb79f86c8100d7f52c2b3db92863299d46317fdd5b3dcee29e8931908de0f32efc1ee1b10dc797e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8e35b396c202871689a0ac51d0a0ad06

SHA1
df37fdfbc809337de8c20918c1c65143a3898928

SHA256
579e27ec068633b7385e51e18a6e1acb0b80b404d863750c030ffc4299958a88

SHA512
24506c461d42d3db901482d0f6792e9eb452a769bc526c5cf3ae433d891e9d49d759249184a29950a81baf2d0396ae6fbaa66c0158116748e938f2853bdfb9bf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b61b1464aef347f10ae9635495d8d406

SHA1
12d4bcd3b91873889266e2395988105532ad2dda

SHA256
93d1dd3af738f431ac4aaf159310b15ee8145eeec5efeea3003566e24f117bc1

SHA512
633a421833d3209f0e991a1bce3a560e062027b9311b5dca8904e48d17ca6f123091a9e6b2ca03e2375cd6919147f810759cbd02dba173ddfc41ddc44afa3eae

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d5ff6448571bed856b443e0871363ced

SHA1
50a9cdd878e57acc27b3ea591b678b3bc75c6325

SHA256
782919734002d73561393bb4a44a3a94ee3eebbf88ca99cd690cd42d923d922c

SHA512
c20982898cf22878316606d0e2e98a661d78a36259b0586c4da6849880da936d013dec6e024601b814811ba481d981ccd79b1cc615c7a8ff54a85594c1d53029

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
73d3ad37fb4bc53187e03b361eb6fdeb

SHA1
1df2e01ad05599f13d601eb238005d9af6481f23

SHA256
94097d89d05c1690cd33389be508d5b08ebf04ce2bcce554a61410d982467b23

SHA512
fbe3192878f81b2961340cbdcd14f0c66e0b3e937122337bd1d7e3d56619ef75b16653b61138921a730210d0d9e42826403207bb2fb4bddcf59147988516a316

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab72A4.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar72A3.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit