2dad69f560134d6b62a0016c99bfa0ae2ef03d878961d43ea5850b9b48e2bc44

Analysis

max time kernel
121s
max time network
133s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
15/07/2024, 13:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

49f70e177816762719e16adc54a7d6a0_JaffaCakes118.html
Size

10KB
MD5

49f70e177816762719e16adc54a7d6a0
SHA1

2dbf0bc03a39d850956d8d0d2d0f0a69e7735a39
SHA256

2dad69f560134d6b62a0016c99bfa0ae2ef03d878961d43ea5850b9b48e2bc44
SHA512

bc4920dd644be30aa4931a14e1ca43793c35194c06c56881cbde7fb74736da221f70488e72075e331d257832b480f75a17aa8e2f5f4a8c1265a50d72d9f2db80
SSDEEP

96:uzVs+ux7y5LLY1k9o84d12ef7CSTUAGT/kzyCwpDMPS/LPAlP8lVHcEZ7ru7f:csz7y5AYS/Bzv2oYbAd8PHb76f

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = d0b40038c6d6da01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "427216812"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000930ed985b08cdd4cb38e38023150682b00000000020000000000106600000001000020000000aa481fd8de7d8e96842b0968c407d576cb85b14b4fbee628b842fd32816160f2000000000e80000000020000200000008c6bcc838a490ac0ace2a74656da57628c56bc16b5fa6781fcd86e3b1d0382e62000000077ef6614eb1e3585b297746d561508f19806e9e410aa4340442cfc10b842b1eb400000000292f65e07fbcaef40eb511be80ef80b3a444b50884bc6daa18fced325e9902e21d98496e9a7c6d524cab99df5b12b18759a455d1515be41a888d44431cd82a2	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{616F93E1-42B9-11EF-9B1E-526E148F5AD5} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000930ed985b08cdd4cb38e38023150682b000000000200000000001066000000010000200000000d1abdf33709a18ea52b40dc606fa87f3cf64d99ffd2edd9e7d1a3550a38b32f000000000e80000000020000200000007db14529f8fd7ebde254f114d3e8ba4731c1fead5611875929f653e216c30266900000008321ded8e566dc66edccdb0dcc4b468fdd4c92912c572352b580d777bbe25afa39f6516dbb30b431f1d28f28f26be4e00b7365009641e3bdb2a04bfec0d695e035e925ab3ab6fd43209ab80fe8acc455045e05f42e9b78f6459ad5f456f74e9d2a9235d8291d6a4b7018bef34e71e3288bf65dd8e748c20e4260b3ac7a0c275a270c5140e6ff352f0459867f9f8523594000000041425e9f31323acecaea19659ae5827d528c3c680c1f43e00a8727707ccc130f2b43a6ed9f550e997a4132a661be4cde20e35bdc3aa7dcc5459bffcad0aee351	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2516	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2516	iexplore.exe
2516	iexplore.exe
2424	IEXPLORE.EXE
2424	IEXPLORE.EXE
2424	IEXPLORE.EXE
2424	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2516 wrote to memory of 2424	2516	iexplore.exe	30
PID 2516 wrote to memory of 2424	2516	iexplore.exe	30
PID 2516 wrote to memory of 2424	2516	iexplore.exe	30
PID 2516 wrote to memory of 2424	2516	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\49f70e177816762719e16adc54a7d6a0_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2516
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2516 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2424

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
13d451314b0650bf130db2147683c127

SHA1
c7212a3b125b47e864083d0c599b1c52d71ddd65

SHA256
ae9a2db88e9ab1629d06e750a1d727eb9af80a5eb92645b3471b21251d89b0ed

SHA512
34a0291ed96e2af9f4e4e738c7d4907b55ad9d7584afea29721b3f80033bcbf5101e56b647175b475e6bb8c97c3008bea29adec32b77784a4293c0fd27138410

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9b1e9123237b4c25a8d9714418166d55

SHA1
ec1419efb8a478f36c9824a26d421ddc0010ba67

SHA256
3323868ffdf0418f5e1aaa1d309e74c75620e734b3811299bec42cf3d10be888

SHA512
4b49944d645ad1b0d46341a243a40f758715e0d0a472f6ac0673f617ed6a770a7168b5ed46e624ec680c7b8510a7812f0c0f0e6f3c48e0454961df25cf75f67f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b4e760030a563c0fd0c03b8056f14d1d

SHA1
ecdf31d93906586268c64287ab25ce47854ff4f6

SHA256
9aad473ce1610f9aef8ccdd6e5311d13c25bf27540dc196977783a454c5ce942

SHA512
0fbfdc59243c554d99a135a2fe9727c1dadc61143c0ab2cf870faab30e026ef6f3c2f91438cd03b54fc07bcb32a9f8c5786add0672c1204ef6c676ccde1ceedd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
bf58ac1b2dea739b01512008ab634297

SHA1
77418d2ab3da539980d7ff13eadf8136d4c88dd1

SHA256
502d31b8994077fa9e40a78e276785f42478f5e60ebe9bc7f51aecea675bbe75

SHA512
354762cea8a24b663db6a579680b1b366fc0dac77835b0f3a98a62ee71b6a290b8fbc2303cf603bde76d21cf59fe82109f0138bf3e88d8eb359dacef6ed99205

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7e7c571d2945b28c28c59f6cac1bb395

SHA1
6e24351a1a86249aaed0ad388c7a79ee8c800b5b

SHA256
5363abe582c5b83c2ea6e60dd74a5c8a8b292ee113f33ddecfa4bbbcf0f50ca2

SHA512
11c656b98b0c94642ad8b2eab33c978102e00ab51aa735978ccde25b512f6e5cec0db3cb6b1bb0a7b78691ca960d63a800d4ef633a9ec22dbee0f6d9e08da60c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f3b1ffb8e163ceac8ce40757114c1f0d

SHA1
3218bf2109bb2f4ac226fbce59ffaf0632d5ff3d

SHA256
3e44ecbc9957af65592ea0689d3c69259ce119e1e3e28f2ac35e8df630d2fda4

SHA512
572c2c9996f99b66834bc68c54b9827c0e741449d7122af8c3923aaeb71d6c7c95d7fe057ce6a64ab19b75832ddf1d5474838b4e507154976b2e55db366a7de6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4fc719cbc576f94be8a3e55af878dceb

SHA1
1b8dcda06246b8bb6216f98d05d319fe0e4a0ff3

SHA256
673428b022d58ac2e2b7f4cb425854e1e2f5a4730073e0eaa453e2038e5d34a7

SHA512
5b16e331548f80f324525d4e16c980cf831d549353e69b9e5954d3699ab614f15c25d12d1b9d036ccaeca3fc758ed403ececd8ef5a8ad246eb94574d8cd7de09

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
39da3f94f5d9dfd425e0dd80f0e9db5a

SHA1
5f289939bb8bf46cc57eb43a280f5da094e668c2

SHA256
7883a37e0771af36d34ca9d19c06f8d28e3b94a332672efa5a09237992672195

SHA512
48e2b9d73fa4650537c2408d1fde1a013498a9ebd3bfe59708b5a707e5387dc7bbd2127d6a8108deff16fae62bd3bfed1ee615d18293a609039ea6565292152b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d4e966c481afb095f38c154550aa73ab

SHA1
f6b8fdd1b57c4a5392ed8aaa15b11d3ce1d11b7e

SHA256
7238f1a50c1fb247e8a1b570a46e49f28be8d6a90af8198ae191beb0724f08f6

SHA512
9a14d9dcf5b5920c659e9f210872f600eaf7455ac366525c101d7e884266510e6435862dae297a9963d6f1b90c632f051e02268a2d35038bdabec1407822e0f6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9889cd5d9478821defb31effb309ed63

SHA1
1e8d5e4aaad196816095f53ee339850e6f20c429

SHA256
ccc1fd5b0ee732e279d91bd008ce183208f3f0419e1a1ecfb9ea59e5d7ea41a0

SHA512
ab449440119073a6c895a4ff6e6eafe5aed827d9491df0a9a2be4bd28d905495aac01d590e3369dd10312612ef7d0da40d41b15a03d3e98a6cedf42969ada51f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f95c1a6e4727c8894ab105124929a885

SHA1
2fe96eab6d066cb976b1fa3d729f72ea0074c9bd

SHA256
710ce359f7edf30a0431b2fd01ce2ee52753694833b72e4b005b9e2f5ea903a4

SHA512
ca6a06efe1b33c63eaa2243bfc19ab658267e2da1e74aa3e65faa24fd545e40dff28832f9a511bc98160f268b273984e735177fdd3e1b0edd7d8a518c8d5b81d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c9cb8a8c1c47b65f1e2a48181d96b1d5

SHA1
701b305edba05d3cc3117dd15718b0bba75ad17e

SHA256
f5b7dd14f5b6682a5d69cce8f32a9b3db91466527e91f8de49fd80d54e72dc57

SHA512
e4259f42271455db5552c5068d854cb8915ab1ffa9b2b061bfdc3bfcf3b45b847d8ac242cc0f5d505ac8db68fdc9576da8424d577044f5bb0d51412bfe107b21

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5611c5192c8d9b5a188a99d728e27407

SHA1
eee73a8256ec0c5aa895bacfb2fe75410f0973f1

SHA256
2ca42b2deffc1e6f8f18d7b2f08751376fae77eaf6e82783471186f3ebc91300

SHA512
208196dcae1740bd24e504864f95d3b516ebcd2a5d918a4231eafe117b38134a28489bb70a96e55ceb43220854a9080585336a5e5785c22b3a06f1ae229d0c45

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d5f33e61f3deb7f78e8fdc5f554dc236

SHA1
02fd034a1ca0c53d540ddb484d12447460c89de1

SHA256
a4c480e97508d78d693c1bc5e82e16686ee15bc5f9de3886cce3587ee2553816

SHA512
ccb73f60499b8416ee7638762321d0804c331dec261a1c6fcc150a5128e62893eb137303340cc1ed05a46955f35222f42da186a2439162c7f5cf57cf91682bdf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b65084783eef443101215d8020238cfd

SHA1
023b44c7df79ad43b746c16be375900ce0f96f79

SHA256
c604793f7cc92a30c129d00f940d9b8dd90375a1fa402121bce5c5d46e2b2cdc

SHA512
be6374a96cc405433327e8a90d64bfd4e2d42ee148bf5bfeb5fdad9fa4a1085f087467c128eb48bd543918845c1352752726a8650bad88b089a333a094851c50

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
98cb046e9db8d8b57c6fb69471a5b3a4

SHA1
c2f51abf3c93ba9899d7f3dbadadf69a2977fe9d

SHA256
609d7fabd41ce8ab8dfa417da0326b2010eee0e114a76eb5dff443d72fc8bdf3

SHA512
c898f7db77497de81931359796bb573db3387ee194eb8764530d9a6373e47041db6c481433af0db4f4fe86611742c26c3d4e24f362388dc2c5556983482386ab

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
afc37519dd1a22628754be2159823ced

SHA1
4897fca2d37600f9340b91e8c59e080e016b9511

SHA256
c638c21a89dd8e925f3a1999ff4a27db00e4cb08efb65b3d4316608beb67ec66

SHA512
4222fc501855b28bc8e933ffa2201604be1d6a03860971048120974775a7e1f5a9f67c0c9b107415ceb787d64206a3f6671f17b82c45d5b73a74b73805f5dbc0

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabEA71.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarEAF1.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit