9265397e01f1c6918ed02012b00fca86e41e3bdfe2656f5e96fe79f8940b2770

Analysis

max time kernel
140s
max time network
147s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
15/07/2024, 09:02

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

491c64fa43baea210250539ed4a3a60e_JaffaCakes118.html
Size

77KB
MD5

491c64fa43baea210250539ed4a3a60e
SHA1

383af1ee34b4356e5ece9f15238af47d76519a99
SHA256

9265397e01f1c6918ed02012b00fca86e41e3bdfe2656f5e96fe79f8940b2770
SHA512

fa6488db00858354c405eb350295f80cd6af4a7c62f4693dde197aa84cd10e36dfe7cb4105e88f348e8ba33c6897ba0d405996ef76e409f01e5f6639dac8ad14
SSDEEP

768:Zcd9QZBC7mOdMw7pC5I9nC4G2Hh+cig5Pd:gQZBCCOdr0IxCCag5Pd

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000062974e5b5f804e45b98349be16bffb7800000000020000000000106600000001000020000000e735f992e2362e22f406f231e2e202c2672d477700930b8f64e6bdbd84037bdf000000000e8000000002000020000000823d8045b20f1d27b8e6375e26fb4f78e125f9392f17c4f1ffe3e134fe103f219000000017421f09db49522fd10fa262afd33849e13a52430a9b560204fc402435e62f2ba236b652fd7cf42f955c7b76c6691cbb390fa4bd477c2a6f99b697cdde6b504d78218751d91b5ca27043c4ad4c67f7239ffeebbf13ad821433693d9c622400e9b4382989dc9929b8952b162a286c8c753ef823b04416f86998b8c21a2a92a47e021cef92abdac5067c0a9ebd2f70c021400000004982ba1ed0e8f05627df40f1a236fa9454b1de7b294739fd8305f4a6165e4b252256b4a36d83057e99da0d1c36d7451ae35ccc81eff00a7a366ec42c50f36bf8	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "427195999"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000062974e5b5f804e45b98349be16bffb780000000002000000000010660000000100002000000049e66eb8da08def0fff92bf4c80be774f3398f4e0695c9d6670d41f7513066cb000000000e80000000020000200000006d5f8f8bdc812b39a88a67ff699b4b6f7af775ccca318e7faa3ccfb9a94840db200000006bca51beb10650db73c1cb6dc5cbf98710a07368116ec7f49ac66796ce8f978f40000000955bd5a02218d6cc831ea7bde1ae8e8bd8decc638fa31707c069309f1e66f73b8aaa9c3441635b2e2d32dbce57a852e4bed9712cbbfd2c171ed9bb9a1248bbba	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{EC882EA1-4288-11EF-9232-D6CBE06212A9} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = d04588c395d6da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2416	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2416	iexplore.exe
2416	iexplore.exe
2400	IEXPLORE.EXE
2400	IEXPLORE.EXE
2400	IEXPLORE.EXE
2400	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2416 wrote to memory of 2400	2416	iexplore.exe	30
PID 2416 wrote to memory of 2400	2416	iexplore.exe	30
PID 2416 wrote to memory of 2400	2416	iexplore.exe	30
PID 2416 wrote to memory of 2400	2416	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\491c64fa43baea210250539ed4a3a60e_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2416
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2416 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2400

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4eff5689cdf1204f8124dfee3f0dd9ca

SHA1
784de4ad3f3b42915eafc0f4aa542eb84c204479

SHA256
dc2b9b16ede18daf204361a7ac816b4c4023eb951664a98c28e0dfb106e24a24

SHA512
2747f4e874bed74411b7859de07f917b875e5c64f9a13df39386ac43cc8eee61b030ae9bd0ced8228fcbaeb14c688a32cfb4bebcb09c786de1c9faee50e17f59

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e0bb2c27a53a6c98ae6489a3b66138b2

SHA1
244c083151de289d85e77c37adcb2d54459212de

SHA256
2f1346c3559d794e36672e9c78343e7898a5709c03c8c9436de133b5954e7798

SHA512
326012591ecd6686b828ceceb52029341be950c23e2e38647cb49e9c1e729ae2475f7ad3bbf206a2115bd0ea500f5ab5aff5b3197b5c247e00382e9ae9a2bbb9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2d830767db8a50197371db8244c4a8cd

SHA1
5f57c87b3c1e99f95129cf45d06653354a6061cd

SHA256
eb7ebc584494f8513a63a754c91562badf28403021935dfc3f81d0962da4b964

SHA512
3f7baba18ae32a9c826af797558fc3ff29824709949b4ad8b96af8e6125360bfc2c262ce52c26958340f337942181302c94e84bc93b9bd37592d9e676740a300

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7acac0e9b670a12611e217f72a5e6ec3

SHA1
095d877af25b219d62720ec1b352de58e4595525

SHA256
947f21d3f4321948e8c28a3c26c95b1b9d0e2f46b8a75b004f5af8468aad0b04

SHA512
ebe226e9758fd3768c3c6619045c52274d228c1433dffab53554b0eb07c85aaa6164ffeeff4fecd46d0e573a8165472329e02e1450f286c5b8a21113624a1d56

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c13c35e6007d604741676e2c55f5c7b6

SHA1
6d87380abd565d52178ac455617ce92a4675dfeb

SHA256
c00337c17eee243ef49d71bdd1eb08af38f7d42e66fbceaabcf0d80c5133cacd

SHA512
8f711b24e526229810e76a088828b47cedfeaf5f0559c0fb0d1449abf13a8911c619197dd4850341628eec8ec483dad3abcdaf504317cb52d781b53613e7861a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1588b344a8de35fee84c216c3ac4882a

SHA1
4efd811d61bc24519bcbfffb056eeb6fd13af43d

SHA256
31a345d3e464d06195d899f515715753309760ad2bf2f9982d4d6b5becddd26d

SHA512
5dcebf171d04579cfab7e2273cc944d8961ec262681a1b0f0c66f4104cb4b26d253fddde34baf83a3bd6c5e291c03541adf02c5bd1192eff1a351692f1fe41ad

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2dd3eef32f30e2664df6c8e98d7b22aa

SHA1
f1dc80234c0ba4935535fd36fa67dcb7e9bd3c9f

SHA256
20022bf6ee9209a4cc15c6b28d0b0d3506abdfc55019a87ff031f7ec7e565dba

SHA512
b2200aa50ca2cc19e88e2494ebb02cdb4a11e193fb6e73e64957ada43f0bbc69678ebe99e2a06f3c2541b15bf283dce0c1ba05cd2c77c10c2fed46d96956b91a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
013af8d2adb2e06afced412fd2a19113

SHA1
191aeea79cfc6c40d53e81c8e0e18fe7b343b975

SHA256
431d0b338a56f9c16f292a09b397de4d10976f9a9f07057607bd55b096f15a4b

SHA512
30bc7f320d284cb77d94c87696992a46ca0b6b3aa9c001b70d927003aa0ae54b1a9b896a3c287f29d6b8d9c620ca8cf3fd8685f40edbeefd260ca2052038a184

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ec7eb51c0ec580e88d17de25ba0b7e03

SHA1
6f1b343d309dc469898f566e4ee633bf5a71a9db

SHA256
ddd58f6e613467158dcf60b0aa514a112094bcd224f502f2c7ae99c0ed857bdd

SHA512
2d87fdf1288626a4077bfd99f1e0c627a26260d9d17c4d2cd10084e774c2901f6167a3e088d349ec134679c81296831810e20c907ba1db560b28f824078e9c68

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
de9fbb5fec3f8f6a3bf8399545a9a2de

SHA1
74a62d5207e43b501eea97cff7c0a43c8dc1fd9c

SHA256
118eeb4fd2752f5f28b9018c641a19ac33b3b30c7147e7acaec21b1ac47e4590

SHA512
7774179b9678999c7d0737b49001c3d7a37264e01e4cb9d04ef58a20926acf0cc6bb2b2effe3366044806beaa80967276e97fbc8589f1a288d322cef32062c70

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
76da7930d6f3ff5044607899c45d64c4

SHA1
d0d27bea8b6302d1ac512ff6bbcb209b6aa72b35

SHA256
9a432f93b52bdb7b03eda65e46fed087a7b088cb8c30ba79ec12ccb7f5301138

SHA512
d5b2e54690d0e3cb62bdaae3ab291f7c418b482618afc257d4f1a146d6239feaae45bbdc83f6a5e388e1485a5bb30321e9346a746170cd99bf47a61559f1b9d1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
536704933f2e8316755e8036768bf07f

SHA1
f0a014c8ce3b5ac77c6b9c5e955f5aee3cfba56b

SHA256
0b85566454efc1a336dfebd4b5a5699a6dc71487ae394625a960ae95aba14d18

SHA512
e20a1906cc6a2834190dd72a86d1f88f093ed87e8e135caf92fdaac4ca3cbdb56923457f37d6e58a5546b22bde7a1bb014859e0acdaf5174e3b1dc83918fabee

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
04d50455011fea65329d5ad7c4a3d35f

SHA1
928771cb806b15492cf17fdf09bc6860aef98799

SHA256
56cbba2498ee303e3f1fdefaa862e63ad39106cdbaad88041bbc90b94d39d1f5

SHA512
ff3e328eeca12a1bb217d69bf3f0686e650d3ba256c33046d26e6ce924df4a7cb9f29676d3a86ed66b641e0f8262b40759d52a29a808cef253a5721c8fa7fb36

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
bc359632bdb0220a0482a52e99516fe2

SHA1
f54072d66650a704f156d3ec606c5716980c81ea

SHA256
6e145b339a3b88fa8e1c30d22ba1eb8ca5d5feb4f3d5365f286b03937bb998cd

SHA512
2ceb35b05b85cd3c8f93323e6dc9a9a4cd8f05425275af0d1d3d21ed6069fdd4786892859e2cb3d2db89c80385de3d9748e29a90642977fc91e2860f272bd080

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e017759eef60764f0335a3fa14b469a5

SHA1
f9d02591553e67dea469fdb4167ab0e7a033d107

SHA256
d1281606a646c16481cc96e306f9421321fb69b3e6f43ca6adae59da70d56ebb

SHA512
a3b068ffa263a436b89ee050ff6ce48552354f070a11f1c78e08d469da0225da6dbb7f8c563d774fcea8a636a94fc706265184b5ca85ab4ed1ecbb9bb57222fc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
81ba4023330467ac6922759d2c964626

SHA1
f8878a9fce18ff24e21a1fff53188c6682b26002

SHA256
c8587842a4e29c387096b3ae832318d7098ffb553edf15cb98f3c3cb18075bde

SHA512
730b6cda4f5cf651b9ed726ac614ad3a914f44e93faede7316caa6ada94cffee49699ebc166a9ba9b5a7be2117b2c173c5360ded6e64cd4c84743a5481c87a49

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabB58C.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarB5DD.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit