d31307610e51b076e14907c5c567f2e5201c6b0dea8b5bc9b98c3b36449841cb

Analysis

max time kernel
119s
max time network
128s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
15/07/2024, 10:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

497498f7d6b7e1f40bcb1e52e33e91d8_JaffaCakes118.html
Size

51KB
MD5

497498f7d6b7e1f40bcb1e52e33e91d8
SHA1

f2f7aeec6b2a216a1f0f27d714deac35293bf64a
SHA256

d31307610e51b076e14907c5c567f2e5201c6b0dea8b5bc9b98c3b36449841cb
SHA512

b26c1a8915639fda3b96608ba638dc3cf974ea91972f9cea0171a45dc1755b37197a1020a42c94bbde3c90790e7a58a6788d897f7c10cc33370a379fcadf52b4
SSDEEP

768:ho13JcDKyHHHWylo6E4DOUGodVhMcHo+qJAodVhB7QOu392qSVUt:jDnHH2gDrCodVhMcI+qJAodVhs2qeUt

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 34 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{CAF89B81-4297-11EF-9A68-F6314D1D8E10} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000082ebb0b9d6f3f0458e93e15bd38f268f00000000020000000000106600000001000020000000d6c877fdb8fe3ba82be64c9de8bd18385a9a766e6c50550bd955ac5baf5eaa52000000000e800000000200002000000093038e740c9099aee9669b0147fe883edd884e3cad43183d6bcfbd82c67aaa0720000000d843d65fd85b18d2e28b757c48beaa9ab80db6a825bfa63621d75947899e229440000000a3311c0c72d8c762ee61afbc0f26ce2e0276e5f229fc8809790d8dd33ba8be91131efc126b38f867c8294f7b9cfe9bc093be3a75f8353ac3ccb40d9ce408e4eb	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000082ebb0b9d6f3f0458e93e15bd38f268f0000000002000000000010660000000100002000000027f6f3a88ec90455789d290a751d9ce2a002d997f7345853bc97e1fd6edebbe8000000000e8000000002000020000000966f879e0c50daec98dc10d85b20308459c1c28c1ff83ea0f1aa7d894b8bc7ed9000000020e3f486521be57034a19535edc7e41879f82f46f1adaf766a28a32598792fbf0d971bb6fb1f4f4d125ea442c50638bcb58fa1360d659d4676070b2daa6f2b918c8afede097114f36a80277cb16141d3342a23a1d0ef9a8f1c7272fe87e8b5e06bcac78014d8918e82a0a4cb25ac6af5a61ccbb62cf3fa9314a62ac001d6d98243506cac0a72d9e592aeb0e7d101eaba400000008033bf069bde931b3682e465d0d2dc97d46d13b70d6f2badbb7539ffae59c0629a66232d3636b4d7bd39143c66e6e837c64ee9cda2aaa452deb8ea1f96af97f3	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "427202386"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 302b19a2a4d6da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2448	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2448	iexplore.exe
2448	iexplore.exe
1760	IEXPLORE.EXE
1760	IEXPLORE.EXE
1760	IEXPLORE.EXE
1760	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2448 wrote to memory of 1760	2448	iexplore.exe	28
PID 2448 wrote to memory of 1760	2448	iexplore.exe	28
PID 2448 wrote to memory of 1760	2448	iexplore.exe	28
PID 2448 wrote to memory of 1760	2448	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\497498f7d6b7e1f40bcb1e52e33e91d8_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2448
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2448 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1760

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f3e7024e7574463b3c4e5ed360412ad7

SHA1
9da4fedc232a631dfdb25e52fe723589b0829443

SHA256
8256996a920bab358ad297c12596646f38fbd2707cce793738305eadb15be566

SHA512
5a2fa3789aa3f0c6101398fd2be2ac71af257a04d1499eeaa609069863af43012e0540f45e4a71b9019e6f22980dc37a7123693de3b5f6fa59bd8d4a16f31d81

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
18609f85d68d053a9431040347c0ef29

SHA1
cea13a9763534149eab5a1068c087e4406ce6b57

SHA256
571674f863d0672925258593dcafd84cfb243f9d11242d94c2f9d6874c458d33

SHA512
1b2e81d039b3d2d00609fcefff3c7027020e0097f0e447b953d9b004c19ff83da5ee90b456fc56dbef19847ecce57d78f370144c19a973bb83ffe70f6c293753

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6353f7af92e7e1f88b8f9a9a11bd6dff

SHA1
1b38a7c0ac2cb5b542aced8c8398f37e819bcdc1

SHA256
8403dedfd0c73b0d6e0130b8a4fd66e8d8c2161b23c03f9240dd6977f79c838e

SHA512
5a8803cc4865f9541265691a80888b988761191ec68c5f550f578558690a0e7cfca4255dd9c09abba209ce6208952a007a0dfb96288abe57bb3aac0dec2fc560

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4fd0665c6bc43be02767060c6c5e0089

SHA1
2b096172b37da3d18559a72f4643d4d4cb9b2226

SHA256
407c0b1f8cff84dff33bd4bc5fe9f22b89f88639f8bd0edb70a75949b63a482f

SHA512
bb8bc91f6dc7f8cd9fb4091d61925b9c8de6c40a9bb53980e6f1cf8d147b47452b45ea5c3ed68cd71579611c6183ac127ecac1732873f59dc6d7eebe595c6ca2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2f2e69de1e5d2bdcf15e755a58f675b4

SHA1
011bb9562efc3d5d1d24cc51927cb0644d700b89

SHA256
5be7a8fc84ac1b91db4d61172ca274869c8471ca363afaf8e6394faf4c594f5a

SHA512
d7038cfeae535a8a0f173b6e7888bea484b32423e4d4f148bf9014a26d9245f5f9496e160b5a6b136a047ea0cd3f0f65efb9427bf27862732c6b68a1e1181fdf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3f99e395cce3af62d9b31a724ee67bd2

SHA1
a9502f063196bec8162f782b6975a125311f2f44

SHA256
faabb6e80fe0710ad7acf12fece5f06e31e0827b30d4f8e0fa1134df4678434d

SHA512
08de40aca8862b306dbcc3013077ecdc3240bbc1b7d7e328b927e4d3575d11b849ef4205dc7f04e7769a76f4fa424a2017658e6e760edc6c4bb5f7a5bbdfcd6b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
cd214e4e11b4709be9a3ee802c5f51d5

SHA1
edb63d1c5cfcde941967124af1c2c34eef011366

SHA256
1a5cc461580f3bf3abd3fb725d92bf5b9dafe6024cc9ecb3c02dc8234a141e26

SHA512
c03ba5ca94ab762a598dcdf3ed04e0644630a10d5ab252b7702afbc631b0f19e519d7327454d85f7c95bf864ba53c4eb7b9b788cc7b81f18a26083ad579fd1ae

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f962c97676a677a2f437846dd6beafe8

SHA1
ba7c2f6ee8bff3873b47a46b46d2f922628df789

SHA256
a09da800c60c384356c65d2d9e1fefc9d30edfe043a8e3d54992f5a57dee05a6

SHA512
d1fddd05e82e55e248861a9dc2f1030d2e7647f83173650361e6886ead9ccf3ad97e8210c9f5b1802bdb123db5c01fc361df6014c3dcb175691f22e382ec2c26

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c9149b37dbed1655121acb9d60888de9

SHA1
a366ba5efde82008f748af005f596747772df3c0

SHA256
ea3b4e07bcb3be296d8859fc3b523eaa9adcea97a950e1b987338d431cd449a5

SHA512
f50aab67be3990f924e7b127de708b0b210b3261253b0d690eb464d0afcd5e7620da007e7bb6bc473aefd6699e170b8ad52681816bf82520c9eb4404680a605a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
bbcf79a74486c79caa5c61aa383a6746

SHA1
6a332abd43c8e91afc540b79e84b0bec5df3f5d1

SHA256
6335c2bac8542355898e9d4fdaf1fb895d74074d0760cda1737f4480f3d84c2f

SHA512
db6485d0fa7c77e9e0f490e3c6cf6ddda61d8e34a1fc0f243e5f2eb8260b916e6561171def1b4727acde15ff557caca45bae77f27c7c1bac1c415a83736304f7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
569560c91c87973d7eef0289bbdf6e38

SHA1
9f92ab0c1b6300030d6f54d8297d8031ea1fe85c

SHA256
2a6eef1b5d1239585407e6bfbaa90c0d777c9f442cee3bd025508a185df7067d

SHA512
51c9a8f3d1a1d523975fcba65aa09d796d7114622d90008b8d0b083bb6cbf7483ef692ee67cab7e150b62dba0c83cf0ad1dd9fe7723f33747dbb8a7d515895df

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabB5BA.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarB5BB.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit