17859da249c4d99824695da7f59bbd338ddc01b99c2f5300a0ca411c7e1ee1c3

Analysis

max time kernel
119s
max time network
129s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
16/07/2024, 00:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

4c0e2cb8ad155cab243fff92fd2a751e_JaffaCakes118.html
Size

9KB
MD5

4c0e2cb8ad155cab243fff92fd2a751e
SHA1

14e6a8688a1c032a75a9fdfadbfb4bfe37e53a41
SHA256

17859da249c4d99824695da7f59bbd338ddc01b99c2f5300a0ca411c7e1ee1c3
SHA512

c87575de0439f8175d20cf1b8698eeb0c94813fd22748e34e989a2517a40b89185b024ce8b3432fc9ae04ab1c9fdbff33352141881ad00626f4a7a6ec6635389
SSDEEP

96:uzVs+ux7U+LLY1k9o84d12ef7CSTU3wGT/kPs8bpUlVHcEZ7ru7f:csz7U+AYS/ughUPHb76f

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{FC914C11-4309-11EF-8F5F-66F7CEAD1BEF} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000930ed985b08cdd4cb38e38023150682b00000000020000000000106600000001000020000000ec08a78cc449e7527ed76e1ac9041d922ff85bc70ccb17272865652b9ef32885000000000e800000000200002000000015e9a1789124774c33e18c73b90329389776a3c9c112b4d6decfd744691a36fa20000000fcd75e1fc1d986136232e6ff2f859205381bb5d0634014d39b88859d538b501940000000ee87d8b8424ec416fe1db77d136632d2e95007de5f5c22be4be7f2c7ad2b1ae00f08952f533ee05f8ea2f8d20ae9e2208d1d833ab061c4c8032d5cbdd6ee4765	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000930ed985b08cdd4cb38e38023150682b00000000020000000000106600000001000020000000d057cb8cdd5828f1db0509b03203f65902c9ceeb787fb30513c07cf281743999000000000e8000000002000020000000a539a7f632b3ffbe43220efc862b225a33aab603e2400d0fa26cc400d50b8e22900000003e0719a046891ddc940efe83b8ed1108501ede95718c4da31082097ab9acfeebf69de926ca668d0201660281dfd787528ad0ace377ab1c977ab8081c4dfcb6dbb7688823cdb3fdfd58f33de379a2b5cb9f7794f457c3214833dcd43dc9887842d4aceb2a731d040634b3dee7fce6adcb73218938c118dd860c309472ec290e7f803ea847a49f554328f63fc1772a07bf40000000f8e7d5c5ad7852b531808f577aac7ede12ba4a3a1f4b7e1282f971a276e49a3706943ccc5f0f03df2ef928dc4e860dbf4b7af33cc00850bc0cba97612af02835	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 709020d316d7da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "427251434"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2148	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2148	iexplore.exe
2148	iexplore.exe
3000	IEXPLORE.EXE
3000	IEXPLORE.EXE
3000	IEXPLORE.EXE
3000	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2148 wrote to memory of 3000	2148	iexplore.exe	30
PID 2148 wrote to memory of 3000	2148	iexplore.exe	30
PID 2148 wrote to memory of 3000	2148	iexplore.exe	30
PID 2148 wrote to memory of 3000	2148	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\4c0e2cb8ad155cab243fff92fd2a751e_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2148
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2148 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:3000

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
df3f09149804304efd6b8e18a06fd78c

SHA1
d37f2343479dfdaedd985b6b41a83608c5e57a36

SHA256
d9b5e69820a551518e6c2986725925621d15d8253f80936d5980477a5a4ab3f4

SHA512
a985c2138b99023a1d4f11f3fded631bcdb92c82a69940169a53fa53e9931563e379fa8bae0f42555e8f0321ac50842e16dd7ba54dec65efd69822bf600f05e4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a423023a30ebb647bf489d58b832496d

SHA1
f78c35e607603b627009e2a88872404478ab44ba

SHA256
415aa4a842cb5700e31d23db9bb5b191c81f14b051f1e964c5e09631b56fa0cf

SHA512
0eb2c940d3b83f5dfb433eb3a7ed3e1a9a7a36d9b9b023184a1462b7fbad5c9d696aa752fa7956bfb1444706d7432374297f08b47f0a923ea2c31742d62794ee

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0e618cd7c8873661e8bf933a35cea64c

SHA1
ccaddfc7dde8b0fc76224ed19bbeb326b2a08bac

SHA256
989566ee6f30705b81ac0d2b966ec5c3bca10c75be3608963be2b0fde60cea6d

SHA512
32e8dad8bacbfdd4e82089662bb1309a6e4d8a74b47945023d669143301a1486377ac9ba4bd373f06287929d298046434941ec977a5fbb03cb24881f3d467a0b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
eda1c8401f7d4ca098f076d49661f34f

SHA1
b9a36a2c6aaaa132184097d9669ff0041c60eeb9

SHA256
e414b41d9d33c0ca51324aef75528a3934f0a9c5e0e9ea8548e90df433d5b821

SHA512
68e4d449c9187e4f3fcaf2b2c15e0a3d31303488137a251e60420772ab36039696c1d05427869976579597b58767194c35b8d8e27d95a5e6ec426608362990bb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
09f6f5b0d31fe56d896ba8a886135979

SHA1
4a1ad17c9df89010c39fab2240cf365cebfbc238

SHA256
97097c5f873205d5f37ac2bf69f78a77f76270e9544787c341ff59eee40b4149

SHA512
f035920d4504f22aa3b512900b7b805846c4b7be4b5f4aa0817417e0361806d9615edaeb7b28bc299b36af9c56f09d197cd5f5a6bf99fc5a472f6a2d84ae2873

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ff2bc81edcd925acfa5f5e34e2c89d07

SHA1
c6eb87a488506711d7a2b3ab867a8a3795c67bbc

SHA256
6b9410232e8b2110c85402a6bddfc9c2a9db1e93d62f43c564e8d99554844446

SHA512
232544f2515d5990f6b7fff02dc0d0b059ff49e68ff5dc7d28f93c3cb93079c327ab89442702b33c2365bb7c3e1bf67daba2c4ba41ab84c6292f5e492b52516b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c59df000849f644e62aedecb06df694d

SHA1
fb939df4f5f79af6c6ce1e2ef6517d4c3b35ccec

SHA256
633ad9232444c5286d3360d7e54b55ab02529f85dba795efc0d09d843b30c593

SHA512
aa8b99955d49cb667ca17e883a267183c2a135cd3682097d1de8a448f256ce283446e3aefe2c76db0e43f7126c3ab556995e7ce547e8fde767068d9d9738b1f1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a9efd89274770c6d0e196313d3e59fa0

SHA1
5a488a7295434bab9aa30a20bcf8bfc2df117c76

SHA256
35ca72da88864a41ecdfd8bc2e6968bacf1ebd269624a2e223202630bcbf354d

SHA512
9eb4abdc09268d4ab6d233b0a1d1deafa5c4630d0481bb2ecd464facc4a5970a4f1c5f507e32c00da75219e2f5eadf2e195135777ce91ee3e6d6e6f4273217d2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c3dff13530bf66c9c2b3eb7e96e0faec

SHA1
ed80069779fb6f82d226899144c8b0d6aa50aef6

SHA256
6e74b6040b3e8cb2cdc89789c306ebfa2acead23926f69bd9d8abfaa904c6c5c

SHA512
4f44bf58d4df38eb90f0a3b6813ed685250696559369cf46c6da3c14b38d296c1d10f240f9344aa777d7983521418af56545783aa4b5952107f90e5cc6d41ffe

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
947da87752a59916477eabe4b95208c0

SHA1
df72cdb34eaab43312b802f59a691e6f3140943e

SHA256
b48fc0b9774feec4778dd7d565c887387468145d256309faf1e61802837da6f3

SHA512
a847ed14f0b9c39ca859d3c3d2fe341fb8596193eccc488f790a39555baecd3bb64e8fd069a1032226b7da7c8bb0d409fdb3ac58c80ed04966a21c17d4c26cb4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1741445d86d4732675dd7235f4219643

SHA1
7329d253e95c47d3739f14b872637bac75da9f45

SHA256
cbf6d8c0c7ff1b2d6bbed1b50fb376ae2b494ce85344384ed51f1b038ddf0da8

SHA512
a292b20c1866ba6c92744caeb10f5b09206a124f87e8a8102cc2d1553beb21f7a311906cc984620221bd29c43ab20ef53879863aac3c0e622f91fb15292dcaa6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2baae41e3c96795e7d2667e5a7dc7106

SHA1
bb5d9a6c3af9de0e603cbe78ae9456a4c3a7f85e

SHA256
182e24ac525d4f8ec4855626b01de168e9de676edb57bdb90bda7a1197110b01

SHA512
9a05f748354394a4fd10efc259836a40a05abd95c9f1f93d060688bf0b8edac40274b42d9a63d23a1d538d39b07f064217f3dc39e7ab78e5a4e6aa7715128ef8

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabD5B9.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarD629.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit