d0b90889ab64404551f2c1256ccf837572e4db59d216c4b5df6982022bc79f37

Analysis

max time kernel
118s
max time network
135s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
15/07/2024, 08:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

49066fb55925601b5e9367e6940a166f_JaffaCakes118.html
Size

6KB
MD5

49066fb55925601b5e9367e6940a166f
SHA1

26b6775a25b463d4e819dc759bc77753851dd002
SHA256

d0b90889ab64404551f2c1256ccf837572e4db59d216c4b5df6982022bc79f37
SHA512

2b6ec2582e9302163bd6fe72f42eafeba29556847a152f303c1b5cac8f0af186355dd51a98fd45460b46d9ada2d0ee2537888f17336718c71486a6caccdfa5b1
SSDEEP

96:uzVs+ux7SK/LLY1k9o84d12ef7CSTUoZcEZ7ru7f:csz7v/AYS/jb76f

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000062974e5b5f804e45b98349be16bffb7800000000020000000000106600000001000020000000d894100f5717507ce7d0217480f8ccb66d2effe5808c63576b358fbfd69bcc88000000000e80000000020000200000009c8a276a4094375f8a733fa870c249c5b44a5d39f5f81baf31d8754ebe639eff2000000013a34b5f0ffb719f6614f5857ed3129a1f8748823ca92c8fa80f8c144bd62126400000007627abffc18362552ca909a314596c36b82c24dc7e4f9d7455b9f7a204928c0e7267f93bd95d75d8f31ad19cd9fa2307d369107bb334807423c3747a7dab7f29	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 602b693e92d6da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{67E64311-4285-11EF-B707-6AA0EDE5A32F} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "427194495"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000062974e5b5f804e45b98349be16bffb78000000000200000000001066000000010000200000004408305e99bdb5263da23cf93f2286427afe85ad8d8e238a54b50cfb00d850a0000000000e80000000020000200000003cea6bda37c37f6649b16ec83b87260f1b8a92648918bacb330f4840c739fb1c90000000822ab78d3823dccb37259463dabdc29de16864db140688aa3b996d66f52942422c7a028d9146788235ec5ccd3d2b522520852c3e8c451cf506f42c1378661dfb10a18542299890d9b4699a53e7796d6d22621d3f7910bed21936908fe723ce59722703ec1b2a9e82d21aba12d619b77c349811d66562655953a082c5454b899e51cfad825cf92732819cb6792b8bdf7240000000eb4ea3efa80a7fb90952f1a9fb07d7254922ed1f04d31d759dffe151db120cc172c16a61314fc02b28b2ab5cbe1054dab83bcab47f5f720b51440b8fe9271c7e	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2340	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2340	iexplore.exe
2340	iexplore.exe
2140	IEXPLORE.EXE
2140	IEXPLORE.EXE
2140	IEXPLORE.EXE
2140	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2340 wrote to memory of 2140	2340	iexplore.exe	31
PID 2340 wrote to memory of 2140	2340	iexplore.exe	31
PID 2340 wrote to memory of 2140	2340	iexplore.exe	31
PID 2340 wrote to memory of 2140	2340	iexplore.exe	31

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\49066fb55925601b5e9367e6940a166f_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2340
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2340 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2140

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b61593c2789df94e3f3ae58e4dcfb3a8

SHA1
492be5d8c4032078a6eddbe7e30a6403c87832d2

SHA256
91878ac4ab631c6c438b610e97811996578006633381c0bf0e740d8fec71b82e

SHA512
b5ce4eb75a8e0ae342f237bcb7689fad7a7e0c7f09b1821649b5f575397f4f55a81640ee5f03f7ccd32d58cf403028715b1f325c9eb657ca789e71eed884f879

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3d1075dfa04f92571a952bc7762b9cea

SHA1
c8d3f1e7ff4a8592451a661814aa783118918023

SHA256
7f2cff8940b3d982789d6738b1c59ae9bf5716231d8adee20e11eed27f99a227

SHA512
91740e9e612168f58da72df214409989a3a4c4f0ce0a125828d941d8aea9e99bf746c15407a8f67b7aab36767a823711924d3c368b9e504cf86a08f0bdf38eaa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c0dceff2fb9b90fc8c8ade3b78609bc0

SHA1
15af664709187e8686ccee4df9ebceec2c009e0c

SHA256
929165dbf1b6044875cce0de3235404027ddbf1c8d4baed6e431724926f08450

SHA512
cb5670a73facf7a469f2283c5bdd49a54b879847b592366c2d79a96fb2a5428caeaac31116eecc78a2d16b84010ec52d34a79f874fbcdf9f939329c834f10d30

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
58e1f6f3b6f1789580aabdc34d0b82bb

SHA1
0d4439dbdd06ce5ecb3efd5a111c94e715c3da58

SHA256
e8d7afbc1ea8d02f85f6a02e861eac0feb1921cd95eae12f7038b99f641e11f2

SHA512
e412275bb7e4c94d58438fc1e31b80068c46b641ef7ce54ac717f0ed61dbe7e8fed4f811109b30a431f46fd7b731a40007e5b287ac0f66ead232a20654341820

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
19729fde090a013526986724029d02de

SHA1
54e69f2858b87f7c097f5851d0cf37c061be9b52

SHA256
07c7e03d7c5556ecf8699c474cadb9eaad4609ae71ccf6072627aced5f93e07b

SHA512
8dc6335b9bb74dd017f7281053f3aab12c5022d7f375af806eb52785ae7bc0d6f8eb26f0e0c4026b4587a23b1dbc7ac05a43b06292fc0226b5a84ca4d8b17f8d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
22ec737a70b3f6e649b708c440a1149c

SHA1
552976ad9257ca92b5fa8deb7c704b228ec7215f

SHA256
3db7fd1680c2e944882caf54eb824460379c1b3f04fb22fe272b5710fc9eee6d

SHA512
ea0bd86912ddaa4ebb9a8bbe4d2a8c158561b8544842133da59234d03570a25cb2c6aa50be436136f5d9f583f232271e5d4f32f6bd7a247fa7d734ae1d4d87f9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
72b79f277f6dc994cae5e35b28831a70

SHA1
3c7a55212ca326c65f5e786ca10102d1a0136b1b

SHA256
422f0fb258410c7588ebbef9ffa54828bf691b4a7dc141233b56351f126ef814

SHA512
c206d1c3ab366387722c05a08d9eece17a42f0cc08ed4273e707bc0edbcd34805f12131e711045e774d3ba004ea6b045f985e8e395ca0f78a60b6b0b5230c9f1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6a0f081750f43aa0d1b0bd86d18d9a62

SHA1
fb168217f3e0e5031d4019f21f8fd57915870067

SHA256
d9c018e416d823ba0077198fab2086289ed018edc8596bf1bfaa9767d6a4ea95

SHA512
a96a23c204aa5db4b9610e3e3fe38da92b03d4514ca80746bdffc0f7fef36c9544cedd334e87eb8c542739f8013fb491fc02620ea3fd9e52bebaf52a31b0fff8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0bfc3aeb6032e10046d6c90e7a821c64

SHA1
15b11283407a6aa310e0a8455f433e76fa65e84d

SHA256
ecff251078eb8c4fbb0cc7796dc354389ba0914d4b30de52a6641078765e06ba

SHA512
f0967412c8aceb06b72802ee36951d13c557294b81eaa3af921a1feffc4ab438f11ba5de6143b2f9e877f03c09d0420f8b07dc643dac5cbf5a538ca856acf11d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
bfbf528701f4c968d10c1c4e65b8d103

SHA1
61fd4cdbababbceb54ff91eb055e221c5eee47f0

SHA256
eaa05af15b06296b754b92d73b9793eb3cf7159e5a52c526644a89d813a561c7

SHA512
6d0f99dfda519fc29c159ae984c538f926669893be8e4e193d8c12357a488bed9de5dd139994ef3cf5f331a88da15f725ed184568f5d13c30fcb0070e1984ae5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5088b8fdd6dd563bb0cbefb931805631

SHA1
6b53ed331d8cbf75db6ce24f34f27036a3409bc4

SHA256
4aca7e48b57251fe429e49ffbbc820b87203587126a73e57ccf283d80829fb2e

SHA512
59cb13d8b827ad89bb9f3736001cb8c18fa3f5e369f0ff3b9af9992ca4b0ead3980be052396eb712bd456fb80bd8dd3e06980594e031fbe269f01c980396c883

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
dd0728d41789a7ec9f877d054ca42433

SHA1
d58308f46f9345599355ec6dd3f96f64f303068a

SHA256
d96001c8e99f6c90d61a31f19c77ce7cdd74fbe499e7d65ff59aeaa53f0201ed

SHA512
777c70e7ff15914fe797fc69c6740d1bf7144e20633cf63409df0d1775ffa22aec5b88b5dabff21af00d08d63f29d5be78b6103b0d4bc2ebe930a6de4816b856

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a4d3b197d4661d12732538892084d9e3

SHA1
0c9f390f879040c4fa3909cd8431fcfdb97c239b

SHA256
4b369e84cbf6692f7bba2bef99990c2a8c88a85fc2824b70dca8f62e3e8a90f3

SHA512
b395c403a142c3174d32f6611289b0d9da894ac1347e4f53dd302381ef2da325260c73386ef9996da1eb5fd8eabed3b1edaa869a1d8b77aa8510cc316352931a

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabF615.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarF685.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit