a5f18475661d85f214a02f5ed2ade6f7878314e58127e9f525e6fc8ead5e1a20

Analysis

max time kernel
133s
max time network
129s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
15/07/2024, 15:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4a42a4f7e2e71c151e47476a41fc30db_JaffaCakes118.html
Size

3KB
MD5

4a42a4f7e2e71c151e47476a41fc30db
SHA1

05113f57429e032ab582bf48613ef1a1c6328a2e
SHA256

a5f18475661d85f214a02f5ed2ade6f7878314e58127e9f525e6fc8ead5e1a20
SHA512

e94f58a21beb908cffd0dc3f9a668d5f39f3a6676b3a4a3eaa59bbe9fb01a18ee5ec69af6075d07cbb844c1769ee93dfbf204c7b0329bdbd230f133d6659dd5b

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "427220652"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 40849415cfd6da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000003e1c4d4a7885794291b78de8e6dfadfd00000000020000000000106600000001000020000000ecf712efcb5de996f501204a69b43e6b41d90f8f66ff845a4770e7fc218836bd000000000e80000000020000200000008ef60be063d29a47973bd1913d793df11cd8b0759b2e794e5bf44780079af2ef20000000f0164cda11e7d71098a5b864ca1d1e50e1d1b4f65cc10a9d93a9d3e65e0df7d840000000114e064d74963df58bd2105b48293679e104f9dbf6119fff9c0ae4b6ae96b223953a290903b739fb7ef6a45e699e4579bdd26dc5cc71e4c76528c4642d81db0e	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{52DB38D1-42C2-11EF-9BD3-424588269AE0} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000003e1c4d4a7885794291b78de8e6dfadfd00000000020000000000106600000001000020000000f0395d2ea5d7855647b24f23d1dacd95ea2e9670a045fd53a30a6030bbde7ad9000000000e80000000020000200000008f56a4fc64ef45371d86e8ac83f0cf03568cbe79d62912b5756894a1d66a66e390000000e8df9ac2965a4e4be179f230e7350ad5d439d62978d7efb1f01d829378c201e24d57e6d71d3c58a437a081d189b250e79914aa27cb910ead23422b58b2683879850bb9c6b7f6b0c9e4671378e1e5a093584b922a428ba2fe6c487c4e1e3712111b752fabea514d1d4dc979ffa0ec9dcd1fcefe6a222ea68acbfcd0206ec671ca087ce0410bb6550847b1727972e10343400000007e312d4eceb68d0e929c2bfdd23168f10efc80be5bab59b487f8fcf48ecac84ce5e4f4b7ed7ec467cb872c789f0ca8d3254470684ad7e18d881b128359bd4e7b	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3028	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
3028	iexplore.exe
3028	iexplore.exe
2556	IEXPLORE.EXE
2556	IEXPLORE.EXE
2556	IEXPLORE.EXE
2556	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3028 wrote to memory of 2556	3028	iexplore.exe	30
PID 3028 wrote to memory of 2556	3028	iexplore.exe	30
PID 3028 wrote to memory of 2556	3028	iexplore.exe	30
PID 3028 wrote to memory of 2556	3028	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\4a42a4f7e2e71c151e47476a41fc30db_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3028
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3028 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2556

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7cb28e0f4d7e5459de042af336773cb5

SHA1
6013842485dae8826d6b3161f89ebfea850b88eb

SHA256
2892454e1638658d8393e97cf0e5307458e60d6347952c1122909ef69dd31064

SHA512
e385c9b84c2b878c654a8df183c9a3b6c888faafc491a1fcd40c7085fa3742fb208c7257c5463a416f43062a793a7eec54653247155db022ef1b46698ad31187

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a21bf46c3ffca7dd4480a5dbfee023ce

SHA1
d7f3d458779fe52ba2637a0c94f3a9e32b7e4888

SHA256
11ac58f79502f937975c06265dc97be74ec1e375fe1c9eb8d37a5583fe50b63e

SHA512
4ff7285f1211af3a53b9544ca00b7ae0c75dae260520233409b6f1ce9f7266882f21b1cb94f43e60eb8e1d47b0c11d7556ffb35087fe1079fc5cb71a28367dea

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
74741d6cda5d975f5665a8eebe7d5faa

SHA1
63394400da87d4fb825a8641449c230625eb0c0d

SHA256
f0c4d099e72c4beb457efe8ee970cdede4bc2e7b5fe75360238dece9407b534b

SHA512
8b44b6bf01002059e64c2132204782fc1d27a0d6ffd89ff80dae33b6023efb7c37b1d61179492d07fca4cda7e3baa8ac4d3619236fbb7aee538470b7d91e4659

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0102c74afb9b678757ade11efa342cc8

SHA1
e1dfe5bfa1843f39f06d0084ef34ce31e125fd4f

SHA256
bee56e47f3f811436ad97b0d530a77f5b39cdedb01a9d2ffac6d338fbbc71fd1

SHA512
3760c6a530679e374c26276954a5c72fd06e75c7ce5ff432877738a2c376267a438181c517cb44ad901246d8917041cd7d63adfa208830b83676c673d86ccdef

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
601766a91621bb932958db3f200f6c6e

SHA1
cc19a9fa904babb0d047c4d435b464fa958409d6

SHA256
1aa6965bf2e99508c60c5453f4aca5614d400e2f3f7e09369166a9cfedcb68ab

SHA512
58af915c65ee4a0d4abf913c76bd2428b93bf64c7b099aa484f3cef9badfad838c2e643427c4c5c196cb19f609ddebb13316ad7801ec4ebfbb2fcf7ffef167f9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c9823fbe89743368d3f388fc05c7bb81

SHA1
942a84f0e18968b7fe97db7fe7e41c41db59b477

SHA256
5cfe29166e3bcdca4fa9f789ce40cf0e5537d89ab3e24b2ac4565372b50130d7

SHA512
58cc4def4985045e781ea04d2aa60e597295e5b5c8f458475e6a40230680384cc9590ce0e214d8b2bf6444ae0546f9b5a197e319beb17783fe43af667bb69dcb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
68a70b85af917aeefa0599af15e9ef14

SHA1
9b37bab00d97389a61818997e0e724ca9222f6a6

SHA256
639c329685baec4a1fe6f9ae75998faa9e1ee5039bd2f26640e91f1f5ffb4b19

SHA512
61833750f5376f5ed39a0b16aeec68e6506bf9a0a52943dc8d2208b6cfa46482814f4383dfe9827422d0a8706bd6d25cb7f445bbd7b1dc8639aa5c87fb7fdaf7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9ee2dd8090335ad16dc6fca29decdc05

SHA1
e15656c24d2ec79e9707849758ae6ada1b4d7fd9

SHA256
0e6a308ce28f01f38549ef5b7bda3434c6e5025cddfba58d16e94ee21bd141c4

SHA512
937742c7a784928aa454dfcd66946bedeb61fd6941f70c7acb53c052a9d2a3284dd8297b32cd527b5396ad25e0e12088176ffd352e93ff78d675156ed18f1f5a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6f08b1f033ae77a60f0b33a7d057580a

SHA1
31156e76c6e88447d92968c5cda2ad1cf095c7a0

SHA256
a38436b6beedcef80d33ea89607334f617aa0ca14a5fda2b9f3a32c6fab3a376

SHA512
5ecb5a51e0a8bf4fa15cc1de87605e8580ff0c78364eae964054665cb89a93bc482a0d50127f54c0b95e7e74bfdd26f6992dd6fd455403c018d44c905b3fb250

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e312a56c79b2e94ab7e5af660b1f7c86

SHA1
76072556022229d32ca8efe08c7f3b96d96f28ac

SHA256
ac91d22aac749e0c1b6cfe7fdd9cde866f97f8a6bacca50fa417175dbff869fa

SHA512
6bd6e354067015aa85651c48654034cbcc503ca30d864a0d31d7ad1278c2115816c0b4e41e1ccc44b62d3a8f1d3d79bb39661ed25774e0b28f2c6684275f24f0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
eda5c41892ca774d96a46071fd203cc2

SHA1
960d5acbb12162ef86d661e4c2313934eb807716

SHA256
379b65b87ee447c58e0e00a2596985c3fb2cab3c879ac36536ea8ce39c797a1e

SHA512
80c603bf4d20274c5374d5dd84b642b554176b035b0acf3898225497e940e2ce6751d1e428f76d56707773b4794aad5c2959225a03a1470112def9ffbae5508c

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabE218.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarE288.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit